Critical severity · published Jan 22, 2025
CVE-2024-12857
AdForest <= 5.1.8 - Authentication Bypass
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenticated attackers to authenticate as any user as long as they have configured OTP login by phone number.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
AdForest · scriptsbundle
through 5.1.8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12857
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12857
Product
https://themeforest.net/item/adforest-classified-wordpress-theme/19481695
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff3b4f1-dd36-43d0-b472-55a940907437?source=cve
More from AdForest
9.8
CVE-2026-1729
AdForest <= 6.0.12 - Authentication Bypass
9.8
CVE-2025-8359
AdForest <= 6.0.9 - Authentication Bypass to Admin
9.8
CVE-2024-11350
AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover
9.8
CVE-2024-11349
AdForest <= 5.1.6 - Authentication Bypass
8.1
CVE-2025-67946
WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability