Lucene search

K
cvelistPatchstackCVELIST:CVE-2024-33686
HistoryApr 29, 2024 - 5:56 a.m.

CVE-2024-33686 Broken Access Control vulnerability affecting multiple WordPress themes by Extend Themes

2024-04-2905:56:41
CWE-862
Patchstack
www.cve.org
2
wordpress
extend themes
security vulnerability
broken access control
missing authorization
cve-2024-33686

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

5

Confidence

High

EPSS

0

Percentile

10.3%

Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea WP: from n/a through 1.0.13; Elevate WP: from n/a through 1.0.15; Brite: from n/a through 1.0.11; Colibri WP: from n/a through 1.0.94; Vertice: from n/a through 1.0.7.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "pathway",
    "product": "Pathway",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.16",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.15",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "hugo-wp",
    "product": "Hugo WP",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.10",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.8",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "althea-wp",
    "product": "Althea WP",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.16",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.13",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "elevate-wp",
    "product": "Elevate WP",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.17",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.15",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "brite",
    "product": "Brite",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.15",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.11",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "colibri-wp",
    "product": "Colibri WP",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.99",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.94",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "vertice",
    "product": "Vertice",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.11",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.7",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

5

Confidence

High

EPSS

0

Percentile

10.3%

Related for CVELIST:CVE-2024-33686