PT-2024-15875 · WordPress · Check & Log Email

Sean Murphy · Published 2024-03-25 · Updated 2024-03-26 · CVE-2024-0866

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Check & Log Email plugin for WordPress versions up to, and including, 1.0.9

Description The issue allows unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. This is possible when the action the attacker wishes to execute has a nonce check, and the nonce is known to the attacker. Additionally, the absence of a capability check is required for this to occur. The check nonce function is involved in this process.

Recommendations For versions up to, and including, 1.0.9, update to a version that fixes the Unauthenticated Hook Injection issue. As a temporary workaround, consider disabling the check nonce function until a patch is available. Restrict access to sensitive actions that rely on nonce checks to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-0866

Affected Products

Check & Log Email

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-0866 · Security Note
• https://twitter.com/CVEnew/status/1772462394674905382 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1772515125347447138 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9ae9307c-680c-43c7-8246-a3e6149c1fb6?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050794%40check-email&new=3050794%40check-email&sfp_email=&sfph_mail= · Note