PT-2025-6442 · WordPress · Convertplus

Lucio Sá · Published 2025-02-12 · Updated 2025-02-12 · CVE-2024-13800

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConvertPlus plugin for WordPress versions up to, and including, 3.5.30

Description The issue allows unauthorized modification of data, potentially leading to a denial of service. This is due to a missing capability check on the 'cp dismiss notice' AJAX endpoint. Authenticated attackers with Subscriber-level access and above can update option values to '1' on the WordPress site, which can be used to create an error on the site, denying service to legitimate users, or to set certain values to true, such as registration.

Recommendations For versions up to, and including, 3.5.30, update to a version higher than 3.5.30 to resolve the issue. As a temporary workaround, consider restricting access to the 'cp dismiss notice' AJAX endpoint until a patch is available.

Fix

DoS

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-13800

Affected Products

Convertplus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-13800 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13800 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/580ae2da-76f2-42b3-a26c-62ad8d6d1686?source=cve · Note
• https://convertplug.com/plus/product/convertplug · Note
• https://t.me/cvedetector/17820 · Telegram Post
• https://twitter.com/CVEnew/status/1889761667069911342 · Twitter Post