7.5

CVE-2024-6750

Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions

Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions

The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.
Mögliche Gegenmaßnahme
Social Auto Poster: Update to version 5.3.15, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpwebinfotech ≫ Social Auto Poster SwPlatformwordpress Version < 5.3.15
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Social Auto Poster
Version *-5.3.14
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.2
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
security@wordfence.com 7.3 3.9 3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/36b58a4f-0761-4775-9010-9c77d4019c44?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/36b58a4f-0761-4775-9010-9c77d4019c44
Third Party Advisory