PT-2024-18189 · WordPress · Accordion

Lucio Sá · Published 2024-04-09 · Updated 2024-04-10 · CVE-2024-1641

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Accordion plugin for WordPress versions up to and including 2.2.96

Description The issue allows authenticated attackers with contributor access and above to access and modify data due to a missing capability check on the accordions duplicate post as draft function. This enables them to duplicate arbitrary posts, including accessing the contents of password-protected posts.

Recommendations For Accordion plugin for WordPress versions up to and including 2.2.96, update to a version higher than 2.2.96 to resolve the issue. As a temporary workaround, consider restricting contributor access to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-1641

Affected Products

Accordion

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-1641 · Security Note
• https://plugins.trac.wordpress.org/changeset?old_path=/accordions/tags/2.2.96&old=3050599&new_path=/accordions/tags/2.2.97&new=3050599&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0e7e7c70-4d07-4550-9cf8-5135b87b67ca?source=cve · Note
• https://plugins.trac.wordpress.org/browser/accordions/tags/2.2.96/includes/duplicate-post.php · Note