PT-2025-10060 · WordPress · The Golo - City Travel Guide Wordpress Theme

Lucio Sá · Publicado 2025-03-07 · Atualizado 2025-03-08 · CVE-2024-12876

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Golo - City Travel Guide WordPress Theme versions up to, and including, 1.6.10

Description The issue allows for privilege escalation via account takeover due to improper validation of a user's identity prior to updating their password. This enables unauthenticated attackers to change arbitrary users' passwords, including administrators, and gain access to their accounts.

Recommendations For versions up to, and including, 1.6.10, update to a version that properly validates user identity before allowing password updates. As a temporary workaround, consider restricting access to password update functionality to prevent unauthorized changes.

Correção

LPE

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2024-12876

Produtos afetados

The Golo - City Travel Guide Wordpress Theme

Referências · 12

• https://wordfence.com/threat-intel/vulnerabilities/id/e6cb81e5-61a4-4b67-a668-d8a7d46b2cea?source=cve · Nota
• https://themeforest.net/item/golo-directory-listing-travel-wordpress-theme/25397810 · Nota
• https://twitter.com/WolfgangSesin/status/1897998336671494501 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1898246391891214353 · Publicação no Twitter
• https://twitter.com/vulns_space/status/1897953091204350276 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/1897928193358602334 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-12876 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1898037921539580302 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-12876 · Nota de Segurança
• https://t.me/cvedetector/19820 · Publicação no Telegram
• https://twitter.com/cybercronai/status/1898003356544647213 · Publicação no Twitter
• https://t.me/cvetracker/18650 · Publicação no Telegram