PT-2024-16451 · Unknown+1 · Th Shop Mania+1

Kevin Murphy + 2 · Published 2024-11-08 · Updated 2025-03-14 · CVE-2024-10674

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Th Shop Mania versions prior to 1.4.9

Description The Th Shop Mania theme for WordPress has a vulnerability due to a missing capability check on the th shop mania install and activate callback() function. This allows authenticated attackers with Subscriber-level access and above to install arbitrary plugins, which can be leveraged to exploit other vulnerabilities and achieve remote code execution and privilege escalation.

Recommendations For Th Shop Mania versions prior to 1.4.9, update to the latest version to secure your site. As a temporary workaround, consider disabling the th shop mania install and activate callback() function until a patch is available. Restrict access to the notification system to minimize the risk of exploitation. Avoid using the vulnerable function to install plugins until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-10674

Affected Products

Th Shop Mania

Wordpress

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-10674 · Security Note
• https://twitter.com/transilienceai/status/1856567522901770516 · Twitter Post
• https://themes.trac.wordpress.org/browser/th-shop-mania/1.4.9/lib/notification/notify.php · Note
• https://t.me/thedarkwebinformer/14582 · Telegram Post
• https://twitter.com/CveFindCom/status/1855090665299861782 · Twitter Post
• https://t.me/cvedetector/10268 · Telegram Post
• https://twitter.com/transilienceai/status/1856567492568563755 · Twitter Post
• https://t.me/cvenotify/101175 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b7832d37-19a9-491b-879e-4a22f2ba46ec?source=cve · Note
• https://twitter.com/cracbot/status/1856940186317591015 · Twitter Post
• https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=247810%40th-shop-mania&new=247810%40th-shop-mania&sfp_email=&sfph_mail= · Note
• https://twitter.com/VulmonFeeds/status/1855161993222623432 · Twitter Post
• https://themes.svn.wordpress.org/th-shop-mania/1.4.9/lib/notification/notify.php · Note
• https://t.me/latest_high_impact_cve/1473 · Telegram Post
• https://twitter.com/CVEnew/status/1855093186022002979 · Twitter Post