PT-2024-28188 · Upqode · Upqode Plum: Spin Wheel & Email Pop-Up

Ananda Dhakal · Published 2024-11-01 · Updated 2024-11-01 · CVE-2024-38744

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Upqode Plum: Spin Wheel & Email Pop-up versions n/a through 2.0

Description The issue affects the Upqode Plum: Spin Wheel & Email Pop-up plugin, allowing access to functionality not properly constrained by ACLs, and stored XSS.

Recommendations For versions n/a through 2.0, update to a version that properly constrains functionality with ACLs and fixes the stored XSS issue. As a temporary workaround, consider restricting access to sensitive functionality until a patch is available. Avoid using the plugin until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-38744

Affected Products

Upqode Plum: Spin Wheel & Email Pop-Up

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-38744 · Security Note
• https://twitter.com/CveFindCom/status/1852357817593713017 · Twitter Post
• https://patchstack.com/database/vulnerability/qodeblock/wordpress-plum-spin-wheel-email-pop-up-plugin-2-0-broken-access-control-to-unauth-stored-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1852358584069238962 · Twitter Post