Unauthorized Access to Data Due to Missing Capability Check
CVE-2024-1352

5.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Classified Listing – Classified Ads & Business Directory Plugin
Vendor
CVE Published:
9 April 2024

Summary

The Classified Listing – Classified ads & Business Directory Plugin for WordPress is vulnerable to unauthorized data access and modification. This issue stems from a missing capability check in the rtcl_import_location() and rtcl_import_category() functions. As a result, authenticated users with subscriber-level access and higher can exploit this vulnerability to create terms, compromising the integrity of the data. Addressing this flaw is crucial for ensuring the security and reliability of WordPress installations utilizing this plugin.

Affected Version(s)

Classified Listing – Classified ads & Business Directory Plugin * <= 3.0.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/classified-lis...
https://plugins.trac.wordpress.org/browser/classified-lis...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.