CVE-2024-1108

🗓️ 21 Feb 2024 03:03:23Reported by WordfenceType

The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_init() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to change the settings of the plugin, which can also cause a denial of service due to a misconfiguration

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2024-1108	21 Feb 202404:21	–	circl
CNNVD	WordPress Plugin Plugin Groups Security Vulnerability	21 Feb 202400:00	–	cnnvd
Cvelist	CVE-2024-1108 Plugin Groups <= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service	21 Feb 202403:03	–	cvelist
EUVD	EUVD-2024-16882	3 Oct 202520:07	–	euvd
NVD	CVE-2024-1108	21 Feb 202403:15	–	nvd
OSV	CVE-2024-1108	21 Feb 202403:15	–	osv
Patchstack	WordPress Plugin Groups Plugin <= 2.0.6 is vulnerable to Broken Access Control	21 Feb 202400:00	–	patchstack
Prion	Design/Logic Flaw	21 Feb 202403:15	–	prion
Positive Technologies	PT-2024-16743 · WordPress · Plugin Groups	20 Feb 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-1108	23 May 202509:40	–	redhatcve

NVD

Vulners

Vulnrichment

Node

davidcramer plugin_groupsRange<2.0.7wordpress

[
  {
    "vendor": "desertsnowman",
    "product": "Plugin Groups",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.0.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3036754/plugin-groups/trunk/classes/class-plugin-groups.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/8298f1fb-3165-40e3-9192-805a07c14cae

08 Apr 2026 18:20Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.5 - 8.2

EPSS0.00111

SSVC

CWE-862