PT-2025-10419 · WordPress · Post Meta Data Manager

Francesco Carlucci · Publicado 2025-03-08 · Atualizado 2025-03-13 · CVE-2024-13835

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Post Meta Data Manager plugin for WordPress versions up to and including 1.4.3

Description The issue arises from the plugin's failure to properly verify the existence of a multisite installation before allowing user meta to be added or modified. This allows authenticated attackers with Administrator-level access and above to gain elevated privileges on subsites that would otherwise be inaccessible.

Recommendations For Post Meta Data Manager plugin for WordPress versions up to and including 1.4.3, update to a version that includes the necessary verification for multisite installations to prevent privilege escalation.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2024-13835

Produtos afetados

Post Meta Data Manager

Referências · 10

• https://osv.dev/vulnerability/CVE-2024-13835 · Aviso do Fabricante
• https://t.me/cvenotify/114488 · Publicação no Telegram
• https://twitter.com/cracbot/status/1900139844552319232 · Publicação no Twitter
• https://t.me/cvedetector/19878 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1898246332243976567 · Publicação no Twitter
• https://t.me/cvetracker/18722 · Publicação no Telegram
• https://t.me/cvenotify/113969 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-13835 · Nota de Segurança
• https://wordpress.org/plugins/post-meta-data-manager · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/568aa6d6-10a1-4653-ab95-845faf005b8e?source=cve · Nota