Scriptsbundle Adforest vulnerabilities

CVE-2024-11350 [CRITICAL] CWE-640 CVE-2024-11350: The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all v The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user's identity prior to updating their password through the adforest_reset_password() function. This makes it possible for unauthenticated attackers to change

CVE-2024-11349 [CRITICAL] CWE-288 CVE-2024-11349: The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and i The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the sb_login_user_with_otp_fun() function. This makes it possible for unauthenticated attackers to log in as arbitrary users, in

CVE-2026-1729 [CRITICAL] CWE-306 CVE-2026-1729: The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and i The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sb_login_user_with_otp_fun' function. This makes it possible for unauthenticated attackers to log in as arbitrary users, inc

CVE-2025-8359 [CRITICAL] CWE-288 CVE-2025-8359: The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and i The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, including administrators, without access to a password.

CVE-2024-12857 [CRITICAL] CWE-288 CVE-2024-12857: The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and i The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenticated attackers to authenticate as any user as long as they have configured OTP login by

CVE-2025-67946 [HIGH] CWE-98 CVE-2025-67946: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclusion.This issue affects AdForest: from n/a through <= 6.0.11.

CVE-2025-67569 [MEDIUM] CWE-862 CVE-2025-67569: Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdForest: from n/a through <= 6.0.11.

CVE-2024-12855 [MEDIUM] CWE-862 CVE-2024-12855: The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sb_remove_ad' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete posts, attachments and deactivate a licens