← Back to CVE List

CVE-2024-9933

Published: 2024-10-26T03:15Z
Last Modified: 2024-10-28T13:58Z
Source: MITRE CVE List
License: MITRE-CVE-TOS
The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.6. This is due to the 'watchtower_ota_token' default value is empty, and the not empty check is missing in the 'Password_Less_Access::login' function. This makes it possible for unauthenticated attackers to log in to the WatchTowerHQ client administrator user. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt