CVE-2024-7424

1 Nov 2024

Título es

CVE-2024-7424

Vie, 01/11/2024 – 08:15

Tipo

CWE-284

Gravedad 2.0 Txt

Pendiente de análisis

Título en

CVE-2024-7424

Descripción en

The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those functions intended for admin use resulting in subscribers being able to upload csv files and view the contents of MPG projects.

01/11/2024

Vector CVSS:3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Gravedad 3.1 (CVSS 3.1 Base Score)

5.40

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)

MEDIUM

Referencias

https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/controllers/DatasetController.php#L261

https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/models/ProjectModel.php#L286

https://plugins.trac.wordpress.org/changeset/3174918/multiple-pages-generator-by-porthas/trunk/controllers/DatasetController.php

https://plugins.trac.wordpress.org/changeset/3174918/multiple-pages-generator-by-porthas/trunk/models/ProjectModel.php