PT-2024-39004 · WordPress · Frontend Post Submission Manager Lite – Frontend Posting Wordpress Plugin
Lucio Sá
·
Published
2024-09-06
·
Updated
2024-09-11
·
CVE-2024-8427
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin versions up to, and including, 1.2.2
Description:
The issue allows authenticated attackers with Subscriber-level access and above to update the plugin's settings and forms due to a missing capability check on the
save global settings and process form edit functions. This enables unauthorized modification of data.Recommendations:
For versions up to, and including, 1.2.2, consider disabling the
save global settings and process form edit functions until a patch is available to prevent unauthorized modification of the plugin's settings and forms. Restrict access to the plugin's settings to minimize the risk of exploitation.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Frontend Post Submission Manager Lite – Frontend Posting Wordpress Plugin