WordPress PublishPress Authors plugin <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover vulnerability

🗓️ 16 Oct 2024 14:07:45Reported by wesley (wcraft)Type

PublishPress Authors plugin up to version 4.7.1 allows authenticated users to arbitrarily update any user email and take over accounts.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-9215	17 Oct 202404:56	–	circl
CNNVD	WordPress plugin PublishPress Authors 安全漏洞	17 Oct 202400:00	–	cnnvd
CVE	CVE-2024-9215	17 Oct 202402:06	–	cve
Cvelist	CVE-2024-9215 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover	17 Oct 202402:06	–	cvelist
EUVD	EUVD-2024-49797	3 Oct 202520:07	–	euvd
NVD	CVE-2024-9215	17 Oct 202402:15	–	nvd
Patchstack	WordPress PublishPress Authors Plugin <= 4.7.1 is vulnerable to Privilege Escalation	16 Oct 202400:00	–	patchstack
Positive Technologies	PT-2024-39496 · WordPress · Publishpress Authors	16 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9215	5 Feb 202504:33	–	redhatcve
Vulnrichment	CVE-2024-9215 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover	17 Oct 202402:06	–	vulnrichment

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/publishpress-authors/co-authors-multiple-authors-and-guest-authors-in-an-author-box-with-publishpress-authors-471-insecure-direct-object-reference-to-authenticated-author-arbitrary-user-email-update-and-account-takeover

16 Oct 2024 14:07Current

7High risk

Vulners AI Score7

CVSS 3.18.8

EPSS0.00338

SSVC