WordPress ImagePress Missing Authorization Arbitrary Post Deletion/Update (CVE-2024-9824/9825)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update 2. Vulnerability Description: - Describes a risk of unauthorized modification and data loss in the ImagePress - Image Gallery plugin, due to missing authorization checks for the and functions. - This vulnerability allows authenticated attackers with Subscriber or higher privileges to delete any post and update post titles arbitrarily. 3. Vulnerability Rating: - CVSS 3.1 Score: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 4.0 Score: 4.3 (Medium) 4. Public Release Date: October 11, 2024 5. Last Updated Date: October 12, 2024 6. Researcher: Michelle Porter - Wordfence 7. Vulnerability IDs: - CVE-2024-9824 - CVE-2024-9825 8. Affected Versions: <= 1.2.2 - Fixed Version: 1.3.0 9. Remediation Recommendation: Upgrade to version 1.3.0 or higher. 10. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 11. Vulnerability Details: - Provides detailed information about the vulnerability, including vulnerability type, software type, software slug, whether it is fixed, and remediation advice. 12. Copyright and Licensing Information: - Copyright and licensing information is provided by Defiant Inc. and MITRE Corporation. 13. Vulnerability Database: - The Wordfence Intelligence WordPress Vulnerability Database is free and accessible via API for querying. 14. Additional Information: - Includes information about Wordfence’s free and paid products, as well as how to receive the latest vulnerability notifications and updates from Wordfence. This information helps users understand the severity, scope of impact, and how to remediate and prevent the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress ImagePress Missing Authorization Arbitrary Post Deletion/Update (CVE-2024-9824/9825)

More from this source