PT-2024-16349 · WordPress · Bard Extra

Lucio Sá · Published 2024-11-20 · Updated 2024-11-21 · CVE-2024-10532

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Bard Extra plugin for WordPress versions prior to 1.2.8

Description The issue allows authenticated attackers with subscriber-level access and above to import demo data due to a missing capability check on the bardxtra import xml() function. This enables unauthorized modification of data.

Recommendations For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider disabling the bardxtra import xml() function until a patch is available. Restrict access to the import functionality to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-10532

Affected Products

Bard Extra

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-10532 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1ad5d2b2-fca8-46bb-8a03-02be07f2a800?source=cve · Note
• https://twitter.com/CVEnew/status/1859451907305087238 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3192923/bard-extra/trunk?contextall=1&old=3048156&old_path=%2Fbard-extra%2Ftrunk · Note
• https://plugins.trac.wordpress.org/browser/bard-extra/trunk/bard-extra.php#L341 · Note