PT-2025-1913 · WordPress · Passwords Manager

Lucio Sá · Published 2025-01-16 · Updated 2025-01-17 · CVE-2024-12614

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Passwords Manager plugin for WordPress versions up to, and including, 1.4.8

Description The issue is related to a missing capability check on the pms save setting and post new pass AJAX actions. This allows authenticated attackers with Subscriber-level access and above to update the plugin's settings and add passwords.

Recommendations For versions up to, and including, 1.4.8, consider disabling the pms save setting and post new pass AJAX actions until a patch is available to prevent unauthorized modification of data. Restrict access to the plugin's settings to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

SQL injection

Weakness Enumeration

CWE-862

CWE-89

Related Identifiers

CVE-2024-12614

Affected Products

Passwords Manager

References · 8

• https://plugins.trac.wordpress.org/changeset/3221505/passwords-manager/trunk/include/pms-settings-ajax-action.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-12614 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12614 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3221505/passwords-manager/trunk/include/pms-passwords-ajax-action.php · Patch
• https://t.me/cvenotify/107613 · Telegram Post
• https://twitter.com/CVEnew/status/1879858728540975184 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/898c5554-fd02-47a2-a1f9-1c488cfab57e?source=cve · Note
• https://t.me/cvedetector/15575 · Telegram Post