Unauthorized Modification of License Key in If Menu Plugin

CVE-2024-7894

What is CVE-2024-7894?

The If Menu plugin for WordPress contains a vulnerability that allows unauthorized modification of the plugin's license key. This is due to the absence of a capability check in the plugin's 'actions' function, making versions up to and including 0.19.1 susceptible to exploitation by unauthenticated attackers. The potential for attackers to modify or delete the license key poses significant risks for WordPress users, as it could lead to unauthorized access and manipulation of plugin capabilities.

References