CVE-2024-12857 is a critical (CVSS 9.8) authentication bypass in the AdForest classified ads theme for WordPress, in versions up to and including 5.1.8. Unauthenticated attackers can log in as any user if the site uses OTP login by phone number. Update the theme or turn that login method off.
What's affected
- AdForest theme for WordPress, all versions up to and including 5.1.8.
- Exposure depends on OTP login by phone number being configured.
The record does not name a fixed version. AdForest is sold through ThemeForest, so check the item page and changelog for a release newer than 5.1.8.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp theme list --format=table | grep -i adforest
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Check the theme version in Appearance, then Themes, or with the command above, including child themes that inherit from it.
- Disable phone number OTP login until you are on a fixed version, if your settings allow it.
- Review recent administrator logins and any new admin accounts.
- Look up CVE-2024-12857 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record says the theme does not properly verify a user's identity before logging them in as that user. Two weakness classes apply: an alternate path that skips the normal check, and a critical function that has no authentication. In practice the OTP step does not prove the visitor owns the account.
Because the result is a full session as any account, an administrator takeover is the realistic worst case. The CVSS vector shows high impact on confidentiality, integrity and availability with nothing required from the attacker beyond network access.
This CVE is an authentication bypass (CWE-288, CWE-306, Authentication Bypass Using an Alternate Path or Channel and Missing Authentication for Critical Function). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Authentication bypass bugs skip the one question a login system exists to answer: who is this person. When the check on the identity is weak or missing, the rest of the access control model stops mattering, because the attacker simply arrives as someone who is allowed in.
For a content site or store the worst case is an administrator session. An admin can install plugins, edit files and create accounts, so a login bypass is often one step from full site control. Fixing it means verifying identity on the server, every time, against something the visitor cannot choose.
Quick check
Am I affected if I do not use OTP login?
The record says the attack works when OTP login by phone number is configured. Check your settings, and still plan to update.
Which weaknesses are listed?
CWE-288 and CWE-306, both about authentication being skipped or absent.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
