PT-2024-18355 · WordPress · Revivepress
Lucio Sá
·
Published
2024-03-20
·
Updated
2024-03-20
·
CVE-2024-1844
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
RevivePress – Keep your Old Content Evergreen plugin for WordPress versions up to, and including, 1.5.6
Description
The issue allows unauthorized access and modification of data due to a missing capability check on the
import data and copy data functions. This makes it possible for authenticated attackers, with subscriber-level access or higher, to overwrite plugin settings and view them.Recommendations
For versions up to, and including, 1.5.6, update to a version higher than 1.5.6 to resolve the issue.
As a temporary workaround, consider restricting access to the
import data and copy data functions until a patch is available.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Revivepress