PT-2024-16450 · WordPress · Top Store
Kevin Murphy
+2
·
Published
2024-11-08
·
Updated
2025-03-14
·
CVE-2024-10673
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Top Store theme for WordPress versions up to, and including, 1.5.4
Description
The issue is related to unauthorized arbitrary plugin installation due to a missing capability check on the
top store install and activate callback() function. This allows authenticated attackers, with subscriber-level access and above, to install arbitrary plugins, which can contain other exploitable vulnerabilities to elevate privileges and gain remote code execution.Recommendations
For versions up to, and including, 1.5.4, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the
top store install and activate callback() function to minimize the risk of exploitation. Additionally, restrict the installation of arbitrary plugins to prevent potential elevation of privileges and remote code execution.Fix
LPE
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Top Store