PT-2025-6442 · WordPress · Convertplus

Lucio Sá · Publicado 2025-02-12 · Atualizado 2025-02-12 · CVE-2024-13800

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConvertPlus plugin for WordPress versions up to, and including, 3.5.30

Description The issue allows unauthorized modification of data, potentially leading to a denial of service. This is due to a missing capability check on the 'cp dismiss notice' AJAX endpoint. Authenticated attackers with Subscriber-level access and above can update option values to '1' on the WordPress site, which can be used to create an error on the site, denying service to legitimate users, or to set certain values to true, such as registration.

Recommendations For versions up to, and including, 3.5.30, update to a version higher than 3.5.30 to resolve the issue. As a temporary workaround, consider restricting access to the 'cp dismiss notice' AJAX endpoint until a patch is available.

Correção

DoS

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2024-13800

Produtos afetados

Convertplus

Referências · 6

• https://wordfence.com/threat-intel/vulnerabilities/id/580ae2da-76f2-42b3-a26c-62ad8d6d1686?source=cve · Nota
• https://convertplug.com/plus/product/convertplug · Nota
• https://t.me/cvedetector/17820 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1889761667069911342 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-13800 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2024-13800 · Aviso do Fabricante