PT-2024-25441 · Extend Themes · Extend Themes Brite+6

Dhabaleshwar Das · Published 2024-04-28 · Updated 2024-04-29 · CVE-2024-33686

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Extend Themes Pathway versions 1.0.15 and earlier Extend Themes Hugo WP versions 1.0.8 and earlier Extend Themes Althea WP versions 1.0.13 and earlier Extend Themes Elevate WP versions 1.0.15 and earlier Extend Themes Brite versions 1.0.11 and earlier Extend Themes Colibri WP versions 1.0.94 and earlier Extend Themes Vertice versions 1.0.7 and earlier

Description The issue is related to a Missing Authorization vulnerability. This vulnerability affects multiple Extend Themes products.

Recommendations For Extend Themes Pathway versions 1.0.15 and earlier, update to a version later than 1.0.15. For Extend Themes Hugo WP versions 1.0.8 and earlier, update to a version later than 1.0.8. For Extend Themes Althea WP versions 1.0.13 and earlier, update to a version later than 1.0.13. For Extend Themes Elevate WP versions 1.0.15 and earlier, update to a version later than 1.0.15. For Extend Themes Brite versions 1.0.11 and earlier, update to a version later than 1.0.11. For Extend Themes Colibri WP versions 1.0.94 and earlier, update to a version later than 1.0.94. For Extend Themes Vertice versions 1.0.7 and earlier, update to a version later than 1.0.7.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-33686

Affected Products

Extend Themes Althea Wp

Extend Themes Brite

Extend Themes Colibri Wp

Extend Themes Elevate Wp

Extend Themes Hugo Wp

Extend Themes Pathway

Extend Themes Vertice

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-33686 · Security Note
• https://patchstack.com/database/vulnerability/hugo-wp/wordpress-hugo-wp-theme-1-0-8-broken-access-control-vulnerability · Note
• https://twitter.com/CVEnew/status/1784830287026987042 · Twitter Post
• https://patchstack.com/database/vulnerability/althea-wp/wordpress-althea-wp-theme-1-0-13-broken-access-control-vulnerability · Note
• https://patchstack.com/database/vulnerability/brite/wordpress-brite-theme-1-0-11-broken-access-control-vulnerability · Note
• https://patchstack.com/database/vulnerability/colibri-wp/wordpress-colibri-wp-theme-1-0-94-broken-access-control-vulnerability · Note
• https://patchstack.com/database/vulnerability/elevate-wp/wordpress-elevate-wp-theme-1-0-15-broken-access-control-vulnerability · Note
• https://patchstack.com/database/vulnerability/pathway/wordpress-pathway-theme-1-0-15-cross-site-request-forgery-csrf-vulnerability · Note
• https://patchstack.com/database/vulnerability/vertice/wordpress-vertice-theme-1-0-7-broken-access-control-vulnerability · Note
• https://twitter.com/linuxpatch/status/1784844321964822587 · Twitter Post