CVE-2024-5545

Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization

Severity Score

5.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stm_edit_delete_user_car function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to unpublish arbitrary posts and pages.

El complemento Motors – Car Dealer, Classifieds & Listing para WordPress es vulnerable a modificaciones no autorizadas de datos debido a una falta de verificación de capacidad en la función stm_edit_delete_user_car en todas las versiones hasta la 1.4.8 incluida. Esto hace posible que atacantes no autenticados anulen la publicación de publicaciones y páginas arbitrarias.

*Credits: Krzysztof Zając

CVSS Scores

Wordfencev3.1 5.3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-30 CVE Reserved
2024-07-01 CVE Published
2024-07-03 EPSS Updated
2024-08-01 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-862: Missing Authorization

CAPEC

References (2)

URL	Tag	Source
https://www.wordfence.com/threat-intel/vulnerabilities/id/62731e0e-8843-4f79-b887-c595fbefae26?source=cve	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3106579%40motors-car-dealership-classified-listings%2Ftrunk&old=3101090%40motors-car-dealership-classified-listings%2Ftrunk&sfp_email=&sfph_mail=	2024-07-05

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Stylemixthemes Search vendor "Stylemixthemes"		Motors - Car Dealer\, Classifieds \& Listing Search vendor "Stylemixthemes" for product "Motors - Car Dealer\, Classifieds \& Listing"				< 1.4.11 Search vendor "Stylemixthemes" for product "Motors - Car Dealer\, Classifieds \& Listing" and version " < 1.4.11"		wordpress		Affected