PT-2024-16088 · WordPress · Wp Project Manager

Matthew Rollings + 1 · Published 2024-11-13 · Updated 2025-02-05 · CVE-2024-10174

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions The WP Project Manager versions up to, and including, 2.6.13

Description The issue is related to Insecure Direct Object Reference, which affects the plugin due to missing validation on the user id user-controlled key in the Abstract Permission class. This allows unauthenticated attackers to spoof their identity as an administrator and access all of the plugin's REST routes.

Recommendations For versions up to, and including, 2.6.13, update the plugin to a version later than 2.6.13 to mitigate the risk. As a temporary workaround, consider restricting access to the plugin's REST routes until a patch is available. Avoid using the user id key in the affected API endpoints until the issue is resolved.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-10174

Affected Products

Wp Project Manager

References · 11

• https://osv.dev/vulnerability/CVE-2024-10174 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10174 · Security Note
• https://plugins.trac.wordpress.org/changeset/3185807/wedevs-project-manager/trunk/core/Permissions/Abstract_Permission.php · Patch
• https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/core/Permissions/Abstract_Permission.php#L32 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/dea2d045-d3b4-4b55-8b4f-5baa82a18834?source=cve · Note
• https://t.me/cvedetector/10796 · Telegram Post
• https://twitter.com/transilienceai/status/1856752832697045179 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1856632803624108066 · Twitter Post
• https://t.me/cvenotify/101493 · Telegram Post
• https://t.me/cvenotify/110121 · Telegram Post
• https://twitter.com/CVEnew/status/1856694192094994470 · Twitter Post