PT-2024-16370 · WordPress · Ti Woocommerce Wishlist

Abrahack · Published 2024-12-03 · Updated 2024-12-09 · CVE-2024-10567

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions TI WooCommerce Wishlist plugin for WordPress versions prior to 2.9.2

Description The issue concerns a missing capability check in the wizard function, allowing unauthenticated attackers to create new pages, modify plugin settings, and perform limited options updates. This enables unauthorized modification of data.

Recommendations For versions up to and including 2.9.1, update to version 2.9.2 or later to resolve the issue. As a temporary workaround, consider disabling the wizard function until a patch is available. Restrict access to the plugin's settings and options to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-10567

Affected Products

Ti Woocommerce Wishlist

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-10567 · Security Note
• https://t.me/cvenotify/102991 · Telegram Post
• https://t.me/cvedetector/11962 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0a5f2e1a-2216-4885-9b74-a08142816f2b?source=cve · Note
• https://twitter.com/theabrahack/status/1864037739005350207 · Twitter Post
• https://twitter.com/CVEnew/status/1864229884165603718 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3199516/ti-woocommerce-wishlist · Note
• https://twitter.com/cracbot/status/1865999906248536225 · Twitter Post