PT-2024-16488 · Seedprod · Website Builder By Seedprod

Lucio Sá · Published 2024-02-01 · Updated 2024-02-13 · CVE-2024-1072

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Website Builder by SeedProd versions up to, and including, 6.15.21

Description The issue is related to a missing capability check on the seedprod lite new lpage function, allowing unauthenticated attackers to modify the contents of coming-soon, maintenance, login, and 404 pages set up with the plugin. It is estimated that around 900,000 WordPress sites are potentially affected.

Recommendations For versions up to, and including, 6.15.21, upgrade to version 6.15.23 to resolve the issue. As a temporary workaround, consider restricting access to the seedprod lite new lpage function until the upgrade is applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-1072

Affected Products

Website Builder By Seedprod

References · 12

• https://plugins.trac.wordpress.org/changeset/3029567/coming-soon/trunk/app/lpage.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-1072 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1072 · Vendor Advisory
• https://twitter.com/autumn_good_35/status/1753411569575473556 · Twitter Post
• https://twitter.com/moton/status/1753380453967704483 · Twitter Post
• https://twitter.com/Dinosn/status/1753281840104804654 · Twitter Post
• https://twitter.com/CVEnew/status/1754620515870810618 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1754673442303938678 · Twitter Post
• https://twitter.com/Komodosec/status/1753942485938905227 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/78d7920b-3e20-43c7-a522-72bac824c2cb?source=cve · Note
• https://t.me/pentestingnews/43331 · Telegram Post
• https://twitter.com/fridaysecurity/status/1753278814447161493 · Twitter Post