Unauthorized Data Modification Vulnerability in ConvertPlus Plugin for WordPress

CVE-2024-13800

Summary

The ConvertPlus plugin for WordPress has a vulnerability where authenticated users, with Subscriber-level access or higher, can exploit a missing capability check on the 'cp_dismiss_notice' AJAX endpoint. This weakness allows attackers to modify option values, potentially leading to a denial of service by creating errors on the site or changing critical configurations, thereby affecting legitimate users and disrupting normal operations.

References