What’s Vulnerable › Vulnerabilities

CVE-2024-9822: Pedalo Connector <= 2.0.5 - Authentication Bypass to Administrator

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-11 · updated 2026-06-17
• Weakness: CWE-288

Description

The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'login_admin_user' function. This makes it possible for unauthenticated attackers to log to the first user, who is usually the administrator, or if it does not exist, then to the first administrator.

Affected products

• pedaloagency Pedalo Connector: through 2.0.5

References

• https://plugins.trac.wordpress.org/browser/pedalo-connector/tags/2.0.5/public/class-pedalo_connector-public.php#L118
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab0d342-bfa7-4760-b839-37c3354414ca?source=cve

Get alerted when CVE-2024-9822 or the next vulnerability affects your stack