Unauthorized Data Modification in Bitly Plugin for WordPress

CVE-2024-12616

What is CVE-2024-12616?

The Bitly's WordPress Plugin is susceptible to unauthorized modification of settings due to a lack of proper capability checks on several AJAX actions. This vulnerability affects all versions up to and including 2.7.3, enabling authenticated attackers—specifically those with Subscriber-level access or higher—to manipulate plugin settings without appropriate permissions, thus posing risks to data integrity and security.

References