Lucene search

WordfenceCVELIST:CVE-2024-6599

HistoryJul 18, 2024 - 2:03 a.m.

CVE-2024-6599 Meks Video Importer <= 1.0.11 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification

2024-07-1802:03:58

Wordfence

www.cve.org

wordpress

vulnerability

api keys

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

21.5%

JSON

The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings function in all versions up to, and including, 1.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin’s API keys

CNA Affected

[
  {
    "vendor": "mekshq",
    "product": "Meks Video Importer",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.0.11",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/meks-video-importer/trunk/includes/class.meks-video-importer-vimeo.php#L74

plugins.trac.wordpress.org/browser/meks-video-importer/trunk/includes/class.meks-video-importer-youtube.php#L98

www.wordfence.com/threat-intel/vulnerabilities/id/eaf9cc48-1ba6-4e9b-9f49-54f7747c26e0?source=cve

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

21.5%

JSON

Related for CVELIST:CVE-2024-6599