Unauthorized Settings Modification Vulnerability in WPBakery Builder Plugin for WordPress

CVE-2024-6579

Summary

The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress contains a vulnerability that allows authenticated users, including those with a Subscriber-level role, to modify plugin settings without proper authorization. This flaw stems from missing capability checks within several functions of the plugin, potentially compromising the security and configuration of any site utilizing the plugin version 1.4.5 and earlier. Promptly updating to the latest version is essential for maintaining the integrity and security of WordPress installations using this plugin.

References