CVE-2024-11349: Adforest Auth Bypass Vulnerability

CVE-2024-11349 Overview

CVE-2024-11349 is an authentication bypass vulnerability in the AdForest theme for WordPress. The flaw affects all versions up to and including 5.1.6. The vulnerability resides in the sb_login_user_with_otp_fun() function, which fails to properly verify a user's identity before authenticating them. Unauthenticated attackers can exploit this weakness over the network to log in as arbitrary users, including administrators. The issue is classified under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel). Successful exploitation yields full administrative control of the affected WordPress site.

Critical Impact
Remote, unauthenticated attackers can log in as any user, including site administrators, leading to complete compromise of the WordPress installation.

Affected Products

Scriptsbundle AdForest theme for WordPress, versions through 5.1.6
WordPress sites running the AdForest classified ads theme
Any deployment exposing the vulnerable OTP login endpoint

Discovery Timeline

2024-12-21 - CVE-2024-11349 published to the National Vulnerability Database
2025-08-12 - Last updated in NVD database

Technical Details for CVE-2024-11349

Vulnerability Analysis

The AdForest theme exposes a one-time password (OTP) login workflow through the sb_login_user_with_otp_fun() function. This function authenticates the requesting client without performing adequate verification of the user's identity or possession of a valid OTP. As a result, an attacker can invoke the login flow and obtain an authenticated session for any registered account on the site. The vulnerability is reachable over HTTP without prior authentication and requires no user interaction. Because WordPress administrator accounts can install plugins, edit theme files, and execute server-side code, this authentication bypass effectively yields remote code execution on the underlying host. The EPSS probability for this CVE is 9.768% at the 93rd percentile, indicating elevated likelihood of exploitation attempts.

Root Cause

The root cause is missing identity verification within the OTP login handler. The sb_login_user_with_otp_fun() function trusts client-supplied parameters to identify the target user and issue an authenticated session, without validating that the caller actually possesses the OTP issued for that account. This pattern maps directly to [CWE-288], where an alternate authentication channel bypasses the primary credential check.

Attack Vector

An unauthenticated remote attacker sends a crafted request to the AdForest OTP login endpoint, specifying a target username or user identifier. The vulnerable handler issues authentication cookies for the chosen account without verifying the OTP. The attacker then accesses the WordPress dashboard with the privileges of that account. Targeting the default admin user or any account with the administrator role grants full control of the site, including plugin installation, file editing, and database access.

No verified public exploit code was available at the time of writing. Refer to the Wordfence Vulnerability Overview for additional technical context.

Detection Methods for CVE-2024-11349

Indicators of Compromise

HTTP POST requests to AdForest AJAX endpoints invoking the sb_login_user_with_otp_fun action from unexpected IP addresses
WordPress authentication cookies issued to administrator accounts without preceding password authentication events in logs
Creation of new administrator accounts, unexpected plugin installations, or modifications to theme and plugin PHP files
Outbound connections from the web server to attacker-controlled infrastructure following suspicious login activity

Detection Strategies

Review web server access logs for requests containing the sb_login_user_with_otp_fun action parameter, particularly from anonymous sources
Correlate WordPress wp_signon and session-issuance events with the absence of corresponding password validation entries
Alert on privilege changes, new administrator role assignments, and modifications to wp-config.php or theme files

Monitoring Recommendations

Enable verbose authentication logging in WordPress via a security plugin and forward logs to a centralized SIEM
Monitor for anomalous session activity tied to administrator accounts, including unusual geolocation or user-agent strings
Track file integrity for the wp-content/themes/adforest/ directory and core WordPress files

How to Mitigate CVE-2024-11349

Immediate Actions Required

Update the AdForest theme to a version newer than 5.1.6 once the vendor releases a patched build available through ThemeForest
Audit all WordPress user accounts for unauthorized administrators and force a password reset for every account
Rotate WordPress secret keys and salts in wp-config.php to invalidate any active attacker sessions
Review installed plugins, theme files, and scheduled tasks for unauthorized changes or webshells

Patch Information

The vendor, Scriptsbundle, distributes AdForest through ThemeForest. Site operators should download the latest theme release from the official ThemeForest product page and verify that the patched version addresses the sb_login_user_with_otp_fun() authentication flow. Consult the Wordfence advisory for current fix status.

Workarounds

Block public access to the vulnerable AJAX action at the web application firewall (WAF) by filtering requests containing action=sb_login_user_with_otp_fun
Temporarily disable OTP login functionality within the AdForest theme configuration where supported
Restrict access to the WordPress administrative interface via IP allowlisting on the web server or reverse proxy
Enforce two-factor authentication on all administrator accounts through a trusted security plugin

bash

# Example nginx rule to block exploitation attempts against the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "sb_login_user_with_otp_fun") {
        return 403;
    }
    if ($request_body ~* "action=sb_login_user_with_otp_fun") {
        return 403;
    }
}