PT-2024-17973 · WordPress · Colibri Page Builder

Lucio Sá · Published 2024-02-23 · Updated 2025-01-15 · CVE-2024-1361

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Colibri Page Builder plugin for WordPress versions up to, and including, 1.0.253

Description The issue is due to missing or incorrect nonce validation on the apiCall() function, making it possible for unauthenticated attackers to call a limited set of functions. These functions can be used to import images, delete posts, or save theme data via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

Recommendations For Colibri Page Builder plugin for WordPress versions up to, and including, 1.0.253, consider disabling the apiCall() function until a patch is available to prevent exploitation. Restrict access to sensitive functions that can be called via the apiCall() function to minimize the risk of unauthorized actions.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-1361

Affected Products

Colibri Page Builder

References · 6

• https://plugins.trac.wordpress.org/changeset/3039597/colibri-page-builder/trunk/extend-builder/api/api.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-1361 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1361 · Vendor Advisory
• https://t.me/cvenotify/107534 · Telegram Post
• https://t.me/cvenotify/72292 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/233a29f5-12bf-4849-9b28-4458a0b0c940?source=cve · Note