CVE-2024-9687: CWE-639 Authorization Bypass Through User-Controlled Key in dueclic AuthPress
The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.
AI Analysis
Technical Summary
The vulnerability CVE-2024-9687 in dueclic's AuthPress plugin for WordPress involves an authorization bypass due to improper validation of a user-controlled key in the 'validate_tg' action. Authenticated attackers with low-level permissions can exploit this to log in as any user, including administrators. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation has been documented yet, and no known exploits are reported in the wild.
Potential Impact
Successful exploitation allows an attacker with subscriber-level access to escalate privileges by logging in as any user, including administrators. This compromises site confidentiality, integrity, and availability, potentially leading to full site takeover or unauthorized administrative actions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level permissions where possible and monitor for suspicious activity related to the 'validate_tg' action. Avoid granting unnecessary permissions to low-privilege users.
CVE-2024-9687: CWE-639 Authorization Bypass Through User-Controlled Key in dueclic AuthPress
Description
The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2024-9687 in dueclic's AuthPress plugin for WordPress involves an authorization bypass due to improper validation of a user-controlled key in the 'validate_tg' action. Authenticated attackers with low-level permissions can exploit this to log in as any user, including administrators. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation has been documented yet, and no known exploits are reported in the wild.
Potential Impact
Successful exploitation allows an attacker with subscriber-level access to escalate privileges by logging in as any user, including administrators. This compromises site confidentiality, integrity, and availability, potentially leading to full site takeover or unauthorized administrative actions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level permissions where possible and monitor for suspicious activity related to the 'validate_tg' action. Avoid granting unnecessary permissions to low-privilege users.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-10-09T13:14:36.188Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6b59b7ef31ef0b5547fb
Added to database: 2/25/2026, 9:36:25 PM
Last enriched: 4/9/2026, 8:39:11 PM
Last updated: 4/11/2026, 5:00:14 PM
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.