CVE-2024-12857: Adforest Auth Bypass Vulnerability

CVE-2024-12857 Overview

The AdForest theme for WordPress contains an authentication bypass vulnerability affecting all versions up to and including 5.1.8. The flaw exists in the theme's OTP login by phone number functionality, where the plugin fails to properly verify a user's identity before authenticating them. Unauthenticated attackers can authenticate as any user on the site, provided that user has configured OTP login by phone number. This vendor is scriptsbundle, and the affected product is the AdForest classified ads theme distributed through ThemeForest. The vulnerability maps to [CWE-288] Authentication Bypass Using an Alternate Path and [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Unauthenticated attackers can log in as any user, including administrators, leading to full site takeover when OTP phone login is enabled.

Affected Products

Scriptsbundle AdForest WordPress theme — all versions through 5.1.8
WordPress sites using AdForest with OTP phone-number login enabled
ThemeForest-distributed AdForest Classified WordPress Theme

Discovery Timeline

2025-01-22 - CVE-2024-12857 published to NVD
2025-01-24 - Last updated in NVD database

Technical Details for CVE-2024-12857

Vulnerability Analysis

The vulnerability resides in the AdForest theme's phone-number OTP (one-time password) authentication flow. The theme accepts authentication requests but does not adequately validate that the requester actually proved possession of the target user's phone number or OTP code. As a result, the login routine logs in the supplied user identity without enforcing the verification step that the OTP mechanism is supposed to provide.

This is an authentication bypass classified under [CWE-288] and [CWE-306]. The attack requires no privileges, no user interaction, and is exploitable over the network. Any account with OTP phone login configured, including administrator accounts, can be impersonated.

Root Cause

The root cause is missing authentication on a critical function. The theme's login handler trusts client-supplied identifiers to establish a WordPress session without first confirming that the OTP challenge was successfully completed for the targeted account. The verification step and the session-issuance step are decoupled, allowing the latter to be invoked without the former.

Attack Vector

An unauthenticated remote attacker sends a crafted request to the AdForest OTP login endpoint, supplying the username or phone number of a target account. Because the server skips proper OTP validation, it issues an authenticated session for that account. The attacker then operates with the target user's full WordPress privileges. When the target is an administrator, the attacker gains complete control of the site, including plugin installation, content modification, and arbitrary PHP execution through theme or plugin editing.

No public exploit code or proof-of-concept has been published at the time of writing. For technical details, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-12857

Indicators of Compromise

Successful WordPress logins to administrator or privileged accounts without corresponding OTP verification log entries
New administrator accounts created shortly after suspicious authentication events
Unexpected plugin or theme installations, or modifications to wp-config.php and theme files
Outbound requests from the WordPress host to attacker-controlled infrastructure following login events

Detection Strategies

Review WordPress authentication logs for logins targeting AdForest's phone-OTP endpoints with anomalous request patterns or missing OTP challenge records
Correlate wp_users and wp_usermeta changes with web access logs to identify privilege escalation
Alert on POST requests to AdForest OTP login handlers originating from unusual source IPs or with malformed parameters

Monitoring Recommendations

Enable verbose authentication logging in WordPress using a security plugin and forward logs to a centralized SIEM
Monitor for the creation of administrator-role users and changes to user capabilities metadata
Track file integrity on the wp-content/themes/adforest directory and core WordPress files

How to Mitigate CVE-2024-12857

Immediate Actions Required

Update the AdForest theme to a version newer than 5.1.8 as soon as the vendor releases a patched build
If a patch is not yet available, disable OTP phone-number login in the AdForest theme settings
Audit all administrator and privileged accounts, rotate passwords, and invalidate active sessions
Review recent user registrations and role changes for signs of unauthorized access

Patch Information

No fixed version is currently published in the NVD entry. Site owners should monitor the ThemeForest Product Page and the Wordfence Vulnerability Report for vendor updates and apply the fix immediately upon release.

Workarounds

Disable the OTP login by phone number feature in AdForest theme configuration until a patched version is installed
Restrict access to WordPress administrative endpoints via a web application firewall or IP allowlist
Enforce multi-factor authentication on all administrator accounts using a separate, audited plugin

bash

# Temporary mitigation: restrict access to AdForest OTP login endpoint at the web server
# Example nginx snippet — adjust path to the actual AdForest OTP handler in your install
location ~* /wp-admin/admin-ajax.php {
    # Allow only trusted IP ranges to reach AJAX endpoints handling OTP login
    allow 203.0.113.0/24;
    deny all;
}