PT-2024-16275 · WordPress · Amp For Wp – Accelerated Mobile Pages

Sean Murphy · Published 2024-02-20 · Updated 2024-02-29 · CVE-2024-1043

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AMP for WP – Accelerated Mobile Pages plugin for WordPress versions up to, and including, 1.0.93.1

Description The issue is related to unauthorized loss of data due to a missing capability check on the amppb remove saved layout data function. This allows authenticated attackers with contributor access and above to delete arbitrary posts on the site.

Recommendations For versions up to, and including, 1.0.93.1, consider disabling the amppb remove saved layout data function until a patch is available to prevent unauthorized data loss. Restrict access to the function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2024-1043

Affected Products

Amp For Wp – Accelerated Mobile Pages

References · 7

• https://osv.dev/vulnerability/CVE-2024-1043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1043 · Security Note
• https://plugins.trac.wordpress.org/changeset/3030425/accelerated-mobile-pages/tags/1.0.93.2/pagebuilder/inc/adminAjaxContents.php?old=3025105&old_path=accelerated-mobile-pages%2Ftags%2F1.0.93.1%2Fpagebuilder%2Finc%2FadminAjaxContents.php · Patch
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.0.93.1/pagebuilder/inc/adminAjaxContents.php#L134 · Note
• https://wordpress.org/plugins/accelerated-mobile-pages · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ffb70e82-355b-48f3-92d0-19659ed2550e?source=cve · Note
• https://twitter.com/CVEnew/status/1760019562177683891 · Twitter Post