Horizon Alert
Summary of the vulnerability and why it matters
The MoreConvert Pro plugin for WordPress has an authentication bypass flaw that allows attackers to take over user accounts. This happens because the plugin doesn't properly invalidate verification tokens when email addresses are changed, enabling unauthorized access to sensitive information and administrative functions.
- Unauthenticated attackers can gain access.
- It affects existing user accounts.
- This issue is critical.
Attack Path
How an attacker could exploit the issue
Unauthenticated attackers can gain administrator access to WordPress sites using the MoreConvert Pro plugin by exploiting a flaw in the guest waitlist verification. They can obtain a verification token for an attacker-controlled email, change that email in the waitlist to a target account's email, and then use the original token to authenticate as that target user.
- Public waitlist feature abuse.
- Authenticated as any user.
- No prior access required.
Live Threat
Current exploitation, exposure, and threat context
This WordPress plugin vulnerability allows unauthenticated attackers to take over user accounts, including administrator roles. Attackers will likely find this attractive because it bypasses authentication with a critical impact. While there is no direct evidence of active exploitation, the potential for widespread compromise is significant.
- Affects public-facing plugin.
- No public exploit code observed.
- KEV list does not include.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize identifying and blocking malicious traffic attempting to exploit the authentication bypass in the MoreConvert Pro WordPress plugin. The vulnerability allows unauthenticated attackers to impersonate existing users, including administrators, by manipulating verification tokens. Immediately investigate logs for suspicious activity related to guest waitlist verification and user impersonation.
- Block traffic from suspicious IPs.
- Monitor for unauthorized user logins.
- Block access to the waitlist feature.
