WordPress Th Shop Mania <= 1.4.9 CVE-2024-10674 Arbitrary Plugin Installation

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation 2. Vulnerability Description: The Th Shop Mania theme is vulnerable to unauthorized arbitrary plugin installation/activation due to a missing capability check in the function, up to and including version 1.4.9. This allows authenticated attackers with subscriber-level access or higher to install arbitrary plugins, which can be leveraged to exploit other vulnerabilities and achieve remote code execution and privilege escalation. 3. Vulnerability Score: CVSS 3.1 Score 8.8 (High), CVSS 2.0 Score 6.8 (Medium). 4. Public Disclosure Date: November 8, 2024. 5. Update Date: November 9, 2024. 6. Fix Status: Fixed. 7. Affected Versions: <= 1.4.9 8. Fixed Version: 1.5.0 9. Vulnerability ID: CVE-2024-10674 10. Vulnerability Type: Theme 11. Vulnerability Impact: Plugin Installation/Activation 12. Vulnerability Scope: WordPress Plugin/Theme 13. Vulnerability Impact Level: Subscriber and above 14. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 15. Vulnerability Scope: WordPress Plugin/Theme 16. Vulnerability Impact Level: Subscriber and above 17. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 18. Vulnerability Scope: WordPress Plugin/Theme 19. Vulnerability Impact Level: Subscriber and above 20. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 21. Vulnerability Scope: WordPress Plugin/Theme 22. Vulnerability Impact Level: Subscriber and above 23. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 24. Vulnerability Scope: WordPress Plugin/Theme 25. Vulnerability Impact Level: Subscriber and above 26. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 27. Vulnerability Scope: WordPress Plugin/Theme 28. Vulnerability Impact Level: Subscriber and above 29. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 30. Vulnerability Scope: WordPress Plugin/Theme 31. Vulnerability Impact Level: Subscriber and above 32. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 33. Vulnerability Scope: WordPress Plugin/Theme 34. Vulnerability Impact Level: Subscriber and above 35. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 36. Vulnerability Scope: WordPress Plugin/Theme 37. Vulnerability Impact Level: Subscriber and above 38. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 39. Vulnerability Scope: WordPress Plugin/Theme 40. Vulnerability Impact Level: Subscriber and above 41. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 42. Vulnerability Scope: WordPress Plugin/Theme 43. Vulnerability Impact Level: Subscriber and above 44. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 45. Vulnerability Scope: WordPress Plugin/Theme 46. Vulnerability Impact Level: Subscriber and above 47. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 48. Vulnerability Scope: WordPress Plugin/Theme 49. Vulnerability Impact Level: Subscriber and above 50. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 51. Vulnerability Scope: WordPress Plugin/Theme 52. Vulnerability Impact Level: Subscriber and above 53. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 54. Vulnerability Scope: WordPress Plugin/Theme 55. Vulnerability Impact Level: Subscriber and above 56. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 57. Vulnerability Scope: WordPress Plugin/Theme 58. Vulnerability Impact Level: Subscriber and above 59. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 60. Vulnerability Scope: WordPress Plugin/Theme 61. Vulnerability Impact Level: Subscriber and above 62. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 63. Vulnerability Scope: WordPress Plugin/Theme 64. Vulnerability Impact Level: Subscriber and above 65. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 66. Vulnerability Scope: WordPress Plugin/Theme 67. Vulnerability Impact Level: Subscriber and above 68. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 69. Vulnerability Scope: WordPress Plugin/Theme 70. Vulnerability Impact Level: Subscriber and above 71. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 72. Vulnerability Scope: WordPress Plugin/Theme 73. Vulnerability Impact Level: Subscriber and above 74. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 75. Vulnerability Scope: WordPress Plugin/Theme 76. Vulnerability Impact Level: Subscriber and above 77. Vulnerability Impact Severity: Remote Code

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Th Shop Mania <= 1.4.9 CVE-2024-10674 Arbitrary Plugin Installation

More from this source