PT-2024-20740 · Xlplugins · Xlplugins Nextmove Lite

Yudistira Arya · Published 2024-06-09 · Updated 2025-03-14 · CVE-2024-25092

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XLPlugins NextMove Lite versions 2.17.0 and earlier

Description The issue is a Missing Authorization vulnerability in XLPlugins NextMove Lite. This vulnerability allows unauthorized access due to the lack of proper authorization checks.

Recommendations For XLPlugins NextMove Lite versions 2.17.0 and earlier, update to a version later than 2.17.0 to resolve the Missing Authorization vulnerability. At the moment, there is no information about additional mitigation measures for this vulnerability.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-25092

Affected Products

Xlplugins Nextmove Lite

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-25092 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25092 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1799758596319719491 · Twitter Post
• https://t.me/cvenotify/97869 · Telegram Post
• https://twitter.com/cracbot/status/1801494829576372686 · Twitter Post
• https://twitter.com/linuxpatch/status/1799775096699081205 · Twitter Post
• https://patchstack.com/database/vulnerability/woo-thank-you-page-nextmove-lite/wordpress-nextmove-lite-plugin-2-17-0-subscriber-arbitrary-plugin-installation-activation-vulnerability?_s_id=cve · Note
• https://t.me/thedarkwebinformer/14593 · Telegram Post
• https://twitter.com/CVEnew/status/1799753178528846015 · Twitter Post
• https://t.me/cvenotify/82423 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1799787237443342601 · Twitter Post