Unauthorized Modification of License Key in If Menu Plugin

CVE-2024-7894

5.3MEDIUM

Key Information

Vendor: If Menu
Vendor: CVE Published:; 7 December 2024

Summary

The If Menu plugin for WordPress is vulnerable to unauthorized modification of the plugin's license key due to a missing capability check on the 'actions' function in versions up to, and including, 0.19.1. This makes it possible for unauthenticated attackers to modify delete or modify the license key.

CVSS V3.1

Score:

5.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Dec 7, 2024

Collectors

NVD Database