Lucene search

[email protected]CVE-2024-33686

HistoryApr 29, 2024 - 6:15 a.m.

CVE-2024-33686

2024-04-2906:15:16

CWE-862

[email protected]

web.nvd.nist.gov

cve-2024-33686

nvd

extend themes

pathway

hugo wp

althea wp

elevate wp

brite

colibri wp

vertice

authorization vulnerability

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.4%

JSON

Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea WP: from n/a through 1.0.13; Elevate WP: from n/a through 1.0.15; Brite: from n/a through 1.0.11; Colibri WP: from n/a through 1.0.94; Vertice: from n/a through 1.0.7.

Affected configurations

Vulners

Node

extend_themespathwayRange≤1.0.15

extend_themeshugo_wpRange≤1.0.8

extend_themesalthea_wpRange≤1.0.13

extend_themeselevate_wpRange≤1.0.15

extend_themesbriteRange≤1.0.11

extend_themescolibri_wpRange≤1.0.94

extend_themesverticeRange≤1.0.7

VendorProductVersionCPE
extend_themespathway*cpe:2.3:*:extend_themes:pathway:*:*:*:*:*:*:*:*
extend_themeshugo_wp*cpe:2.3:*:extend_themes:hugo_wp:*:*:*:*:*:*:*:*
extend_themesalthea_wp*cpe:2.3:*:extend_themes:althea_wp:*:*:*:*:*:*:*:*
extend_themeselevate_wp*cpe:2.3:*:extend_themes:elevate_wp:*:*:*:*:*:*:*:*
extend_themesbrite*cpe:2.3:*:extend_themes:brite:*:*:*:*:*:*:*:*
extend_themescolibri_wp*cpe:2.3:*:extend_themes:colibri_wp:*:*:*:*:*:*:*:*
extend_themesvertice*cpe:2.3:*:extend_themes:vertice:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
extend_themes	pathway	*	cpe:2.3::extend_themes:pathway::::::::*
extend_themes	hugo_wp	*	cpe:2.3::extend_themes:hugo_wp::::::::*
extend_themes	althea_wp	*	cpe:2.3::extend_themes:althea_wp::::::::*
extend_themes	elevate_wp	*	cpe:2.3::extend_themes:elevate_wp::::::::*
extend_themes	brite	*	cpe:2.3::extend_themes:brite::::::::*
extend_themes	colibri_wp	*	cpe:2.3::extend_themes:colibri_wp::::::::*
extend_themes	vertice	*	cpe:2.3::extend_themes:vertice::::::::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "pathway",
    "product": "Pathway",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.16",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.15",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "hugo-wp",
    "product": "Hugo WP",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.10",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.8",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "althea-wp",
    "product": "Althea WP",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.16",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.13",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "elevate-wp",
    "product": "Elevate WP",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.17",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.15",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "brite",
    "product": "Brite",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.15",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.11",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "colibri-wp",
    "product": "Colibri WP",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.99",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.94",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "vertice",
    "product": "Vertice",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.11",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.7",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/althea-wp/wordpress-althea-wp-theme-1-0-13-broken-access-control-vulnerability

patchstack.com/database/vulnerability/brite/wordpress-brite-theme-1-0-11-broken-access-control-vulnerability

patchstack.com/database/vulnerability/colibri-wp/wordpress-colibri-wp-theme-1-0-94-broken-access-control-vulnerability

patchstack.com/database/vulnerability/elevate-wp/wordpress-elevate-wp-theme-1-0-15-broken-access-control-vulnerability

patchstack.com/database/vulnerability/hugo-wp/wordpress-hugo-wp-theme-1-0-8-broken-access-control-vulnerability

patchstack.com/database/vulnerability/pathway/wordpress-pathway-theme-1-0-15-cross-site-request-forgery-csrf-vulnerability

patchstack.com/database/vulnerability/vertice/wordpress-vertice-theme-1-0-7-broken-access-control-vulnerability

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.4%

JSON

Related for CVE-2024-33686

wpvulndb1 cvelist1 nvd1 wordfence1