PT-2024-38461 · WordPress · Wp Delicious – Recipe Plugin

🗓️ 11 Sep 2024 00:00:00Reported by Positive TechnologiesType

WP Delicious Recipe Plugin up to 1.6.9 has path validation flaws in save edit profile details(), enabling users to move and read files.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-7626	11 Sep 202411:09	–	circl
CNNVD	WordPress plugin WP Delicious 安全漏洞	11 Sep 202400:00	–	cnnvd
CVE	CVE-2024-7626	11 Sep 202407:31	–	cve
Cvelist	CVE-2024-7626 WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read	11 Sep 202407:31	–	cvelist
EUVD	EUVD-2024-48515	3 Oct 202520:07	–	euvd
NVD	CVE-2024-7626	11 Sep 202408:15	–	nvd
OSV	CVE-2024-7626	11 Sep 202408:15	–	osv
Patchstack	WordPress WP Delicious plugin <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read vulnerability	11 Sep 202400:59	–	patchstack
Patchstack	WordPress WP Delicious Plugin <= 1.6.9 is vulnerable to Arbitrary File Download	11 Sep 202400:00	–	patchstack
RedhatCVE	CVE-2024-7626	5 Feb 202511:55	–	redhatcve

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-7626
plugins	www.plugins.trac.wordpress.org/changeset/3148996/delicious-recipes/trunk/src/dashboard/class-delicious-recipes-form-handler.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/3c98bb53-9f7e-4ab3-9676-e3dbfb4a0519
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
t	www.t.me/cvedetector/5339
t	www.t.me/latest_high_impact_cve/1135
plugins	www.plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.6.7/src/dashboard/class-delicious-recipes-form-handler.php
twitter	www.twitter.com/oktsec/status/1833796170587550154
plugins	www.plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.6.7/src/dashboard/class-delicious-recipes-form-handler.php
twitter	www.twitter.com/CVEnew/status/1833775315887513820

25 Sep 2024 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.1

EPSS0.03817

SSVC