PT-2024-37396 · WordPress · Sparkle Demo Importer

Lucio Sá · Published 2024-06-21 · Updated 2024-06-24 · CVE-2024-6120

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Sparkle Demo Importer plugin for WordPress versions up to and including 1.4.7

Description: The issue arises from a missing capability check on multiple functions, allowing authenticated attackers with Subscriber-level access and above to perform unauthorized actions. This includes deleting all posts, pages, and uploaded files, as well as downloading and installing a limited set of demo plugins.

Recommendations: For versions up to and including 1.4.7, update to a version that includes a fix for the missing capability check issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-6120

Affected Products

Sparkle Demo Importer

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-6120 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6120 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L541 · Note
• https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L519 · Note
• https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L627 · Note
• https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L469 · Note
• https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L446 · Note
• https://t.me/cvenotify/84094 · Telegram Post
• https://twitter.com/CVEnew/status/1804301070497386609 · Twitter Post
• https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L595 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8f411d17-5b0d-4a4a-afa8-7efebf6965f2?source=cve · Note
• https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L570 · Note
• https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L497 · Note