Unauthorized Modification of Data Vulnerability in Coming Soon & Maintenance Plugin
CVE-2024-9705

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Ultimate Coming Soon & Maintenance
Vendor
CVE Published:
6 December 2024

Summary

The Ultimate Coming Soon & Maintenance plugin for WordPress has a security issue related to unauthorized data modification arising from a missing capability check in the 'ucsm_update_template_name_lite' function. This vulnerability allows authenticated attackers, even those with Subscriber-level access, to alter the names of templates used by the plugin. Affected versions include all releases up to and including 1.0.9. It is highly recommended for users of this plugin to review their installations and apply necessary updates to protect against potential exploitation.

Affected Version(s)

Ultimate Coming Soon & Maintenance * <= 1.0.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/ultimate-comin...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tieu Pham Trong Nhan
.