CVE-2024-8427: WordPress Frontend Post Submission Manager Lite Missing Authorization to Authenticated Settings Update

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Frontend Post Submission Manager Lite - Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update 2. Vulnerability Severity: Medium (4.3) 3. CVE ID: CVE-2024-8427 4. Public Release Date: September 5, 2024 5. Update Date: September 6, 2024 6. Researcher: Lucio Sá 7. Affected Versions: <= 1.2.2 8. Fixed Version: 1.2.3 9. Vulnerability Description: The plugin lacks proper authorization checks when saving global settings and handling form editing functionality, allowing attackers with Subscriber or higher privileges to modify plugin settings and forms. 10. Reference Link: plugins.trac.wordpress.org 11. Remediation Recommendation: Upgrade to version 1.2.3 or later, which includes the fix. 12. Copyright Information: This record is copyrighted and published by Defiant Inc. and MITRE Corporation. 13. Vulnerability Database: Wordfence Intelligence’s WordPress vulnerability database is free and accessible via API. 14. Free API Access: Wordfence offers free personal and commercial API access, along with free Webhook integrations, to stay updated on the latest vulnerabilities. 15. Notification Service: Installing the Wordfence plugin enables immediate notifications if your website is affected by any vulnerability added to the database. 16. Documentation: Documentation on how to access and consume vulnerability data via API. This information helps users understand the vulnerability in detail and take appropriate actions to remediate and prevent exploitation.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-8427: WordPress Frontend Post Submission Manager Lite Missing Authorization to Authenticated Settings Update

More from this source