PT-2024-22942 · WordPress · The Networker - Tech News Wordpress Theme

Muhammad Zeeshan + 1 · Published 2024-03-27 · Updated 2024-03-27 · CVE-2024-2962

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Networker - Tech News WordPress Theme with Dark Mode theme for WordPress versions up to, and including, 1.1.9

Description The issue is related to a missing capability check on the admin reload nav menu() function, which allows unauthenticated attackers to modify the location of display menus. This makes it possible for unauthorized modification of data.

Recommendations For versions up to, and including, 1.1.9, consider disabling the admin reload nav menu() function until a patch is available to prevent unauthorized modification of data. Restrict access to the admin navigation menu to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-2962

Affected Products

The Networker - Tech News Wordpress Theme

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-2962 · Security Note
• https://twitter.com/VulmonFeeds/status/1772934156218933398 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1c2b9858-eb0c-42bd-bc32-c58c0f809fc8?source=cve · Note
• https://t.me/cvenotify/74827 · Telegram Post
• https://gist.github.com/Xib3rR4dAr/ab293092ffcfe3c14a3c7daf5462a50b · Note
• https://twitter.com/CVEnew/status/1772909569293099374 · Twitter Post
• https://gist.github.com/Xib3rR4dAr/f5f5d07263fdac28b6e9ba2f6c4e4523 · Note