Ce21 Suite vulnerabilities

CVE-2024-10284 [CRITICAL] CWE-288 CVE-2024-10284: The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and in The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in the 'ce21_authentication_phrase' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to t

CVE-2024-54293 [CRITICAL] CWE-266 CVE-2024-54293: Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalati Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through <= 2.2.0.

CVE-2024-10294 [HIGH] CWE-862 CVE-2024-10294: The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a miss The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single_sign_on_save_api_settings' function in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to change plugin settings.

CVE-2024-10285 [HIGH] CWE-200 CVE-2024-10285: The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token.