CVE-2024-1072

🗓️ 05 Feb 2024 21:21:50Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

The Website Builder by SeedProd is vulnerable to unauthorized data modification; update to version 6.15.2

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2024-1072	22 Feb 202419:47	–	circl
CNNVD	WordPress plugin Website Builder by SeedProd Security Vulnerability	5 Feb 202400:00	–	cnnvd
Cvelist	CVE-2024-1072 Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Authorization via seedprod_lite_new_lpage	5 Feb 202421:21	–	cvelist
EUVD	EUVD-2024-16847	3 Oct 202520:07	–	euvd
NVD	CVE-2024-1072	5 Feb 202422:16	–	nvd
OpenVAS	WordPress Minimal Coming Soon - Coming Soon Page Plugin < 6.15.22 Missing Authorization Vulnerability	18 Feb 202500:00	–	openvas
Patchstack	WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd Plugin <= 6.15.21 is vulnerable to Broken Access Control	1 Feb 202400:00	–	patchstack
Prion	Design/Logic Flaw	5 Feb 202422:16	–	prion
RedhatCVE	CVE-2024-1072	5 Feb 202505:22	–	redhatcve
Vulnrichment	CVE-2024-1072 Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Authorization via seedprod_lite_new_lpage	5 Feb 202421:21	–	vulnrichment

NVD

Vulners

Node

seedprod website_builder_by_seedprodRange≤6.15.21wordpress

[
  {
    "vendor": "seedprod",
    "product": "Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "6.15.21",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3029567/coming-soon/trunk/app/lpage.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/78d7920b-3e20-43c7-a522-72bac824c2cb

Parameter	Position	Path	Description	CWE
page	query param	/wp-admin/admin-post.php	Unauthenticated modification of SeedProd plugin pages via admin-post endpoint to set pages to blank state (e.g., maintenance/coming soon/404/login).	CWE-862
id	query param	/wp-admin/admin-post.php	Unauthenticated modification of SeedProd plugin pages via admin-post endpoint to set pages to blank state (e.g., maintenance/coming soon/404/login).	CWE-862
type	query param	/wp-admin/admin-post.php	Unauthenticated modification of SeedProd plugin pages via admin-post endpoint to set pages to blank state (e.g., maintenance/coming soon/404/login).	CWE-862

08 Apr 2026 18:20Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.5 - 8.2

EPSS0.00215

SSVC

CWE-862