CVE-2024-50477

WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability

9.8 CriticalPublic exploit

Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

8.12%Up 8.1 points since Oct 29, 2024

What each source reports

CVE List Score used 9.8

WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability

Record: CVE-2024-50477
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-288
Updated: 2026-11-02

EUVDEUVD-2024-44903 9.8

Record: EUVD-2024-44903
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5q53-766v-93h8 9.8

Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile...

Record: GHSA-5q53-766v-93h8
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-288, CWE-306
Updated: 2026-11-02

NVD 9.8

Record: CVE-2024-50477
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-288, CWE-306
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Stacks Mobile App Builder 5.2.3 - Authentication Bypass via Account Takeover	2025-07-08
Nuclei	WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass
PoC in GitHub	RandomRobbieBF/CVE-2024-50477	2024-11-08

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-50477 is a critical vulnerability (CVSS 9.8) in Stacks Mobile App Builder, published October 28, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.12%, the 94th percentile. No source names a fixed version.