CVE-2024-39639 WordPress File Upload plugin <= 4.24.7 - Broken Access Control + CSRF vulnerability

Broken Access Control vulnerability in Nickolas Bossinas WordPress File Upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress File Upload: from n/a through 4.24.7...

CVE-2024-43118

CVE-2024-43118 is a Missing Authorization vulnerability in the WordPress plugin Hummingbird (WPMU DEV) caused by incorrectly configured access control. Connected PT Security data identifies the affected software as WPMU DEV Hummingbird versions 3.9.1 and earlier, with a remediation recommended to...

CVE-2024-43122

CVE-2024-43122 describes a Missing Authorization (Broken/Incorrect Access Control) vulnerability in the Robin image optimizer WordPress plugin, affecting version 1.6.9 and earlier. The CVE notes that exploitation requires Network access with Low attack complexity and Low privileges, with potentia...

CVE-2024-43136

CVE-2024-43136 corresponds to a Missing Authorization/Broken Access Control vulnerability in the Sunshine Photo Cart WordPress plugin (Sunshine Photo Cart) affecting versions up to and including 3.2.1. Connected sources identify this as a Broken Access Control issue; the advisory notes affected s...

CVE-2024-43134 WordPress Waitlist Woocommerce plugin <= 2.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in xootix Waitlist Woocommerce Back in stock notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Waitlist Woocommerce Back in stock notifier : from n/a through 2.6...

CVE-2024-43142

CVE-2024-43142 is a Missing Authorization vulnerability affecting Tutor LMS versions up to 2.7.3. Public sources (NVD, RH) confirm a Missing Authorization/Access Control issue with Themeum Tutor LMS and list Tutor LMS (n/a through 2.7.3) as affected. NVD CVSS v3.1 base score is 8.8 ( HIGH ) with ...

CVE-2024-43157

CVE-2024-43157 (WordPress FormCraft) is documented in multiple sources with concrete technical details in connected docs: FormCraft (WordPress Form Builder) versions 1.2.10 and earlier are affected by a Missing Authorization vulnerability due to incorrectly configured access control. The issue is...

CVE-2024-43208

CVE-2024-43208 describes a Missing Authorization vulnerability in the WordPress plugin Send Emails with Mandrill (Miller Media). Affected versions are 1.4.1 and earlier, with exploitability stemming from misconfigured access control. Public sources in the Connected documents explicitly identify t...

CVE-2024-43229 WordPress WP Search Analytics plugin <= 1.4.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cornel Raiu WP Search Analytics search-analytics.This issue affects WP Search Analytics: from n/a through = 1.4.9...

CVE-2024-43254 WordPress Smart Online Order for Clover plugin <= 1.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a through = 1.5.6...

CVE-2024-43254

CVE-2024-43254 affects the WordPress plugin Clover Online Orders (Smart Online Order for Clover). The connected docs identify a Missing Authorization issue due to misconfigured access control in Smart Online Order for Clover up to version 1.5.6. The Wordfence/CVE entries note the vulnerability as...

CVE-2024-43285

CVE-2024-43285 describes a Missing Authorization vulnerability in Presto Player (WordPress plugin) that affects version 3.0.2 and earlier. The issue arises from incorrectly configured access control security levels, enabling unauthorized access to restricted functions. According to the sources, C...

CVE-2024-43293

CVE-2024-43293 is a Missing Authorization vulnerability in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor plugin (affected:

CVE-2024-43296

CVE-2024-43296: WordPress HTML5 Video Player (bPlugins Flash & HTML5 Video) has a Missing Authorization flaw affecting versions up to 2.5.30. Exploitation involves unauthorized access due to misconfigured access control, potentially exposing videos. CVSS v3.1 metrics indicate high impact to confi...

CVE-2024-43298 WordPress Clone plugin <= 2.4.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5...

CVE-2024-43314 WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.9.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.3...

CVE-2024-43314

CVE-2024-43314 affects WordPress Asset CleanUp: Page Speed Booster (versions up to 1.3.9.3). Root cause: Missing/Incorrectly configured access control (Missing Authorization) enabling unauthorized access to assets. Impact: High (as per NVD CVSS 3.1 base score 8.8, high confidentiality, integrity,...

CVE-2024-43355

CVE-2024-43355 is a Missing Authorization vulnerability in the WordPress plugin JoomSport (BearDev) for Sports: Team & League. Affects JoomSport versions up to and including 5.3.0; root cause is misconfigured Access Control Security Levels, enabling unauthorized access. CVSSv3.1 base score 8.8 (N...

CVE-2024-43928 WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in eyecix JobSearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through 2.5.4...

CVE-2024-43925

CVE-2024-43925 describes a Missing Authorization vulnerability in the Envira Gallery WordPress plugins (Envira Gallery Lite / Envira Photo Gallery) affecting versions up to and including 1.8.14. The issue arises from incorrectly configured access control/security levels, enabling a bypass of auth...