PT-2024-16811 · WordPress · The Classified Listing – Classified Ads & Business Directory Plugin
Dale Mavers
+1
·
Published
2024-11-19
·
Updated
2024-11-22
·
CVE-2024-11194
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
The Classified Listing – Classified ads & Business Directory Plugin versions prior to 3.1.15.2
Description
The issue is related to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the
rtcl import settings function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited arbitrary options on the WordPress site. The vulnerability is limited in that the option updated must have a value that is an array. This can be leveraged to update the Subscriber role with Administrator-level capabilities to gain administrative user access to a vulnerable site.Recommendations
Update to version 3.1.15.2 to secure your site.
As a temporary workaround, consider restricting access to the
rtcl import settings function until a patch is available.
Restrict the update of arbitrary options on the WordPress site to minimize the risk of exploitation.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
The Classified Listing – Classified Ads & Business Directory Plugin