CVE-2019-25763
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk34th percentile — higher than 34% of all known CVEs
Summary
The WordPress Ultimate Addons for Beaver Builder plugin version 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality.
Risk Assessment
Attackers can gain access to the administrator account, posing a serious security threat to the entire site.
Recommendation
It is recommended to update the plugin to the latest version and monitor access logs for unauthorized login attempts.
Original NVD description (English source)
WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and authenticate as that user.