Skip to content
Sign in
8.1 High

CVE-2024-13373 The Exertio Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up…

Description

The Exertio Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.1. This is due to the plugin not properly validating a user's identity prior to updating their password through the fl_forgot_pass_new() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Affected products and versions

Product Affected versions Fixed in
Exertio Framework 1.3 earliest → 1.3.1 No fix stated

Other CVEs of Exertio Framework

The 2 CVEs of Exertio Framework →
CVE-2025-49402 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scriptsbundle… 8.5 High
Track this CVE