{"id":"CVE-2024-10245","aliases":["EUVD-2024-32994","GHSA-c379-gmcc-4r2m"],"status":"published","title":"Relais 2FA \u003c= 1.0 - Authentication Bypass","description":"The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the 'rl_do_ajax' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01196,"percentile":0.68335,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-288"],"published":"2024-11-12T09:30:17Z","modified":"2026-06-17T06:55:14Z","exploits":[{"source":"pocgithub","id":"RandomRobbieBF/CVE-2024-10245","title":"RandomRobbieBF/CVE-2024-10245","date":"2024-11-17","url":"https://github.com/RandomRobbieBF/CVE-2024-10245"}],"products":[{"vendor":"mobisoft974","product":"relais 2fa"},{"vendor":"mobisoft974","product":"relais_2fa"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d476336-e997-4379-a8f6-963ae22b2417?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/relais-2fa/trunk/relais.php?rev=2439540#L39"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10245"},{"url":"https://github.com/advisories/GHSA-c379-gmcc-4r2m"}],"sources":{"cve":[{"id":"CVE-2024-10245","title":"Relais 2FA \u003c= 1.0 - Authentication Bypass","description":"The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the 'rl_do_ajax' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.","status":"published","published":"2024-11-12T09:30:17.585Z","modified":"2026-04-08T16:51:24.902Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2024-32994","description":"The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the 'rl_do_ajax' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.","status":"published","published":"2024-11-12T09:30:17Z","modified":"2026-04-08T16:51:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:59.483414Z"}],"ghsa":[{"id":"GHSA-c379-gmcc-4r2m","title":"The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and...","description":"The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the 'rl_do_ajax' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.","status":"published","published":"2024-11-12T12:32:34Z","modified":"2024-11-12T12:32:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:58:46.999726Z"}],"nvd":[{"id":"CVE-2024-10245","description":"The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the 'rl_do_ajax' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.","status":"published","published":"2024-11-12T10:15:04.003Z","modified":"2026-06-17T06:55:14.217Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:10:36.931115Z"}]}}