CVE-2024-9302 is a privilege escalation vulnerability in the App Builder – Create Native Android & iOS Apps On The Flight WordPress plugin. The issue arises from weak password recovery mechanisms, specifically in the verify_otp_forgot_password() and update_password() functions, which lack sufficient controls to prevent brute forcing of OTPs or verifying the legitimacy of password reset requests. This flaw allows unauthenticated attackers to generate and brute force OTPs to reset passwords of any user, including administrators, leading to account takeover.

An attacker can perform a brute force attack on the OTP used in the password recovery process to reset passwords for any user account, including administrative accounts. This results in full account takeover and potential complete compromise of the affected WordPress site. The vulnerability has a CVSS 3.1 score of 8.1, indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the password reset functionality if possible and monitor for suspicious activity related to password resets. Avoid using affected versions of the plugin in production environments.