What is the CVSS score of CVE-2024-49328?

CVE-2024-49328 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 54.5%.

Which versions of WP REST API FNS are affected by CVE-2024-49328?

The WP REST API FNS WordPress plugin contains a critical authentication bypass allowing unauthenticated remote attackers to access protected REST API functionality.

How to fix or mitigate CVE-2024-49328?

24 hours: Identify all WordPress installations running WP REST API FNS plugin version 1.0.0 and below; disable the plugin immediately if not critical to operations. 7 days: Implement Web Application Firewall (WAF) rules to restrict REST API endpoints to authorized users; enable API request logging and rate limiting. 30 days: Monitor Patchstack vulnerability database and plugin repository for patch release; prepare to update immediately when available; evaluate alternative plugins if vendor timeline is unclear.

WP REST API FNS CVE-2024-49328

CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2024-10-20 audit@patchstack.com

Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 20, 2024 - 08:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through <= 1.0.0.

AnalysisAI

Authentication bypass in the WP REST API FNS WordPress plugin (versions up to and including 1.0.0) allows remote unauthenticated attackers to access protected functionality by leveraging an alternate path or channel that circumvents authentication checks. With a CVSS of 9.8 and EPSS at 54.50% (98th percentile), this vulnerability presents substantial exploitation risk, though no public exploit identified at time of analysis. The flaw maps to CWE-288 and was reported by Patchstack.

Technical ContextAI

WP REST API FNS is a WordPress plugin published by author vivek2tamrakar (CPE: cpe:2.3:a:vivektamrakar:wp_rest_api_fns) that extends WordPress REST API functionality. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), a class of weakness in which a protected resource is reachable through a secondary code path that does not enforce the same authentication checks as the primary path. In the WordPress REST API context, this typically manifests when a plugin registers REST routes or endpoints with a permission_callback that returns true unconditionally, omits the callback, or exposes a parallel handler that bypasses the gating logic used elsewhere.

RemediationAI

No vendor-released patch identified at time of analysis - the affected range extends through the latest published version 1.0.0 with no fixed version indicated in the input data. Administrators should deactivate and remove the WP REST API FNS plugin until a fixed release is published, and monitor the Patchstack advisory database for an updated version. As compensating controls, restrict access to the WordPress REST API namespace registered by this plugin at the web server or WAF layer (for example, blocking or authenticating requests to /wp-json/ paths associated with rest-api-fns), or place the affected site behind an authenticated reverse proxy; the trade-off is that legitimate REST consumers of the plugin's endpoints will also be blocked. Hardening WordPress REST API exposure broadly (disabling unauthenticated REST access via filters such as rest_authentication_errors) will mitigate this specific flaw at the cost of breaking any anonymous REST functionality elsewhere on the site.