CVE-2024-1710
Addon Library <= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in all versions up to, and including, 1.3.76. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions including uploading arbitrary files.
El complemento Addon Library para WordPress es vulnerable al acceso no autorizado a los datos debido a una falta de verificación de capacidad en la acción de la función onAjaxAction en todas las versiones hasta la 1.3.76 incluida. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, realicen varias acciones no autorizadas, incluida la carga de archivos arbitrarios.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-02-21 CVE Reserved
- 2024-02-23 CVE Published
- 2024-02-25 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-862: Missing Authorization
CAPEC
References (2)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Unitecms Search vendor "Unitecms" | Addon Library Search vendor "Unitecms" for product "Addon Library" | <= 1.3.76 Search vendor "Unitecms" for product "Addon Library" and version " <= 1.3.76" | en |
Affected
| ||||||