PT-2024-39596 · WordPress · Sendgrid For Wordpress

Nir Kum + 2 · Published 2024-10-17 · Updated 2024-10-22 · CVE-2024-9364

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SendGrid for WordPress plugin versions up to, and including, 1.4

Description The issue is related to a missing capability check on the wp mailplus clear logs function, which allows authenticated attackers with Subscriber-level access and above to delete the plugin's log files, resulting in unauthorized loss of data.

Recommendations For SendGrid for WordPress plugin versions up to, and including, 1.4, consider disabling the wp mailplus clear logs function until a patch is available to prevent unauthorized deletion of log files.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-9364

Affected Products

Sendgrid For Wordpress

References · 7

• https://osv.dev/vulnerability/CVE-2024-9364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9364 · Security Note
• https://plugins.svn.wordpress.org/wp-sendgrid-mailer/tags/1.4/wp-sendgrid-mailer.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/bb7d99a7-1e7d-43e1-839c-286b454c8276?source=cve · Note
• https://twitter.com/CVEnew/status/1847136621185192312 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-sendgrid-mailer/trunk/wp-sendgrid-mailer.php#L167 · Note
• https://t.me/cvedetector/8281 · Telegram Post