PT-2024-15813 · WordPress · Enjoy Social Feed

Erwan Lr · Published 2024-03-14 · Updated 2024-03-18 · CVE-2024-0780

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Enjoy Social Feed plugin for WordPress versions through 6.2.2

Description The issue concerns a lack of authorization in the database reset functionality of the plugin, allowing any authenticated user to reset the database. This means that even users with limited privileges, such as subscribers, can perform this action.

Recommendations For versions through 6.2.2, consider disabling the database reset functionality until a patch is available to prevent unauthorized access. Restrict access to the plugin's settings to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-0780

Affected Products

Enjoy Social Feed

References · 6

• 🔥 https://wpscan.com/vulnerability/be3045b1-72e6-450a-8dd2-4702a9328447 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-0780 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0780 · Vendor Advisory
• https://twitter.com/CVEnew/status/1769826046466302457 · Twitter Post
• https://t.me/pentestingnews/44700 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1769827317348446297 · Twitter Post