PT-2024-18369 · WordPress · Disable Json Api

Lucio Sá · Published 2024-02-28 · Updated 2025-02-11 · CVE-2024-1860

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress versions up to, and including, 4.51

Description The issue is related to unauthorized modification of data due to a missing capability check on the antihacker add whitelist() function. This allows unauthenticated attackers to add their IP address to the whitelist, circumventing protection.

Recommendations For versions up to, and including, 4.51, consider disabling the antihacker add whitelist() function until a patch is available to prevent unauthorized modification of data. Restrict access to the whitelist functionality to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-1860

Affected Products

Disable Json Api

References · 8

• https://osv.dev/vulnerability/CVE-2024-1860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1860 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040434%40antihacker&new=3040434%40antihacker&sfp_email=&sfph_mail= · Patch
• https://twitter.com/CVEnew/status/1762847261774520337 · Twitter Post
• https://t.me/cvenotify/72539 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3d365284-73ac-4730-a83d-9202677cf161?source=cve · Note
• https://t.me/cvenotify/110936 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1762804195571220968 · Twitter Post