PT-2024-29678 · WordPress · Bulk Posts Editing For Wordpress

🗓️ 15 May 2024 00:00:00Reported by Positive TechnologiesType

Bulk Posts Editing for WordPress up to 4.2.3 has missing capability checks in AJAX actions enabling post creation and taxonomy changes.

Reporter	Title	Published	Views	Family All 10
CVE	CVE-2024-4199	15 May 202401:56	–	cve
Cvelist	CVE-2024-4199 Bulk Posts Editing For WordPress <= 4.2.3 - Authenticated (Subscriber+) Missing Authorization	15 May 202401:56	–	cvelist
EUVD	EUVD-2024-32753	3 Oct 202520:07	–	euvd
NVD	CVE-2024-4199	15 May 202402:15	–	nvd
Patchstack	WordPress Bulk Posts Editing For WordPress Plugin <= 4.2.3 is vulnerable to Broken Access Control	14 May 202400:00	–	patchstack
Patchstack	WordPress Bulk Posts Editing For WordPress plugin <= 4.2.3 - Authenticated (Subscriber+) Missing Authorization vulnerability	14 May 202412:31	–	patchstack
RedhatCVE	CVE-2024-4199	23 May 202508:45	–	redhatcve
Vulnrichment	CVE-2024-4199 Bulk Posts Editing For WordPress <= 4.2.3 - Authenticated (Subscriber+) Missing Authorization	15 May 202401:56	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (May 13, 2024 to May 19, 2024)	23 May 202415:00	–	wordfence
WPVulnDB	Bulk Posts Editing For WordPress < 4.2.4 - Authenticated (Subscriber+) Missing Authorization	14 May 202400:00	–	wpvulndb

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-4199
plugins	www.plugins.trac.wordpress.org/changeset
t	www.t.me/cvenotify/79806
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/683131a0-eec3-4251-b322-5c2088855687

15 May 2024 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.14.3

EPSS0.00145

SSVC