WebSpy buys Marketboomer

More severe of the two is CVE-2024-10542, which evades authorization for the plugin's remote call and plugin installation function, according to a report from Defiant.

Initial compromise of the package was evident with "sync.py" script modifications in aiocpa version 0.1.13 that facilitated the execution of a blob code subjected to multiple encoding and compression that ultimately allowed Telegram bot-based exfiltration of Crypto Pay API tokens.

Malicious actors could leverage the vulnerability, which stems from improper user check error management in the two-factor REST API action, to facilitate high-privileged account breaches that could then be used for additional attacks, according to Defiant, a WordPress security provider.