Unauthorized modification of data possible in ShopLentor plugin due to missing capability check

CVE-2024-4566

What is CVE-2024-4566?

The ShopLentor plugin for WordPress contains a significant vulnerability that allows unauthorized modification of data due to a crucial missing capability check in the ajax_dismiss function. This issue affects all versions up to and including 2.8.8. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to set arbitrary WordPress options to 'true'. Furthermore, if the WooCommerce plugin is deactivated or the default WordPress admin dashboard is made accessible to authenticated users, even attackers with subscriber or customer-level access can leverage this security gap. As a result, this vulnerability poses a serious threat to the integrity of WordPress sites utilizing the ShopLentor plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References