PT-2024-38342 · WordPress · Zotpress

Rafshanzani Suhada · Published 2024-11-05 · Updated 2024-11-08 · CVE-2024-7429

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zotpress plugin for WordPress versions up to, and including, 7.3.12

Description The issue allows unauthorized modification of data due to a missing capability check on the Zotpress process accounts AJAX function. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin's settings.

Recommendations For versions up to, and including, 7.3.12, update to a version higher than 7.3.12 to resolve the issue. As a temporary workaround, consider restricting access to the Zotpress process accounts AJAX function to prevent unauthorized modifications.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2024-7429

Affected Products

Zotpress

References · 7

• https://plugins.trac.wordpress.org/changeset/3153348/zotpress/trunk/lib/admin/admin.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-7429 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7429 · Vendor Advisory
• https://t.me/cvedetector/9839 · Telegram Post
• https://twitter.com/CVEnew/status/1853736857432965177 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1f38676b-270f-4b0f-bc98-a14a26b86a50?source=cve · Note
• https://plugins.trac.wordpress.org/browser/zotpress/trunk/lib/admin/admin.php#L40 · Note