Unauthorized Data Modification in ZoomSounds WordPress Plugin

CVE-2024-13776

What is CVE-2024-13776?

The ZoomSounds plugin for WordPress is susceptible to an issue that allows authenticated users with Subscriber-level access or higher to perform unauthorized modifications of data. Specifically, the plugin lacks a critical capability check for the 'dzsap_delete_notice' AJAX action, affecting all versions up to and including 6.91. This vulnerability enables adversaries to alter option values, which could lead to service disruptions for legitimate users by causing errors on the site or modifying essential registration settings. Other functions within the plugin may also be vulnerable due to insufficient authorization checks.

References