PT-2025-1775 · WordPress · Croma Music

Tonn · Published 2025-01-07 · Updated 2025-01-07 · CVE-2024-12202

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Croma Music plugin for WordPress versions up to, and including, 3.6

Description The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to a missing capability check on the ironMusic ajax function. This enables authenticated attackers with Subscriber-level access and above to update arbitrary options on the WordPress site, which can be leveraged to gain administrative user access.

Recommendations For versions up to, and including, 3.6, update to version 3.7 to fix the ironMusic ajax capability check. As a temporary workaround, consider disabling the ironMusic ajax function until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-12202

Affected Products

Croma Music

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-12202 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4ce8e0f1-5a7b-41a3-81d0-7fd12c9da6d9?source=cve · Note
• https://t.me/cvenotify/106535 · Telegram Post
• https://croma.irontemplates.com/lowtempo/wp-content/themes/croma/changelog.txt · Note
• https://t.me/cvedetector/14495 · Telegram Post
• https://twitter.com/CVEnew/status/1876533418730876938 · Twitter Post
• https://twitter.com/CveFindCom/status/1876532299879088449 · Twitter Post