Unauthorized Data Loss in zStore Manager Basic Plugin for WordPress
CVE-2024-13715

4.3MEDIUM

Key Information:

Vendor
Ilenejohnson
Status
Zstore Manager Basic
Vendor
CVE Published:
30 January 2025

Summary

The zStore Manager Basic plugin for WordPress suffers from an unauthorized data loss vulnerability. A missing capability check in the zstore_clear_cache() function allows authenticated attackers with Subscriber-level access and above to clear the cache of the plugin. This can lead to potential disruptions in service and data integrity risks, highlighting the need for immediate remediation.

Affected Version(s)

zStore Manager Basic * <= 3.311

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/zstore-manager...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis
.