Autonettv Relay
Monthly
Authentication bypass in the AutoNetTV Relay WordPress plugin (all versions before 3.0.14) allows unauthenticated remote attackers to obtain a WordPress administrator session cookie by triggering the plugin's scheduled content-synchronization task under a specific server configuration. The plugin issues an admin authentication cookie during the sync task without performing any capability or authorization check, and on servers where the scheduled task completes before the HTTP response is committed, the cookie is returned to the triggering request. A public proof-of-concept exploit exists, reported by WPScan; no KEV listing has been identified at time of analysis.
Authentication bypass in the AutoNetTV Relay WordPress plugin (all versions before 3.0.14) allows unauthenticated remote attackers to obtain a WordPress administrator session cookie by triggering the plugin's scheduled content-synchronization task under a specific server configuration. The plugin issues an admin authentication cookie during the sync task without performing any capability or authorization check, and on servers where the scheduled task completes before the HTTP response is committed, the cookie is returned to the triggering request. A public proof-of-concept exploit exists, reported by WPScan; no KEV listing has been identified at time of analysis.