PT-2024-39255 · WordPress · Donation Forms By Charitable

Wesley

·

Published

2024-09-23

·

Updated

2024-09-26

·

CVE-2024-8791

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress versions up to, and including, 1.8.1.14
Description: The issue is due to the plugin not properly verifying a user's identity when the ID parameter is supplied through the update core user() function. This allows unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then be used to log in to those user accounts.
Recommendations: For versions up to, and including, 1.8.1.14, consider disabling the update core user() function until a patch is available to prevent exploitation. Restrict access to the ID parameter to minimize the risk of unauthorized account updates. Avoid using the ID parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-8791

Affected Products

Donation Forms By Charitable