PT-2024-37752 · WordPress · The Rss Aggregator

Peter Thaleikis · Published 2024-07-16 · Updated 2024-08-07 · CVE-2024-6621

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress versions up to, and including, 4.23.11

Description The issue allows authenticated attackers with Subscriber-level access and above to modify data without authorization due to a missing capability check on the wprss activate feed source and wprss pause feed source functions. This enables them to activate or pause existing RSS feeds.

Recommendations For versions up to, and including, 4.23.11, consider disabling the wprss activate feed source and wprss pause feed source functions until a patch is available to prevent unauthorized modification of RSS feeds.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-6621

Affected Products

The Rss Aggregator

References · 8

• https://osv.dev/vulnerability/CVE-2024-6621 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/feed-states.php#L28 · Patch
• https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/feed-states.php#L12 · Patch
• https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/feed-states.php?rev=3118231 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-6621 · Security Note
• https://t.me/cvedetector/928 · Telegram Post
• https://t.me/cvenotify/86308 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8e37331b-0b75-41ee-b390-532efd674cc1?source=cve · Note