CVE-2024-49328
WordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerability
- Published
- Oct 20, 2024
- Updated
- Apr 28, 2026
- Assigning CNA
- Patchstack
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
- Percentile
- 72.6%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through <= 1.0.0.
Sources
2WP REST API FNS <= 1.0.0 - Privilege Escalation
- CVE-2024-49328-exploitExploit
Python script to exploit a privilege escalation vulnerability in the WP REST API FNS WordPress plugin, allowing unauthenticated creation of administrator accounts.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.