CVE-2024-1095

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1095
The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the settings_export() function in all versions up to, and including, 1.3.5.4. This makes it possible for unauthenticated attackers to export the plugin's settings.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/control-block-patterns/trunk/classes/Settings/SettingsPage.php#L166 Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/38f09a45-2b11-47c7-af16-c7f9c3a46e0e?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/control-block-patterns/trunk/classes/Settings/SettingsPage.php#L166 Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/38f09a45-2b11-47c7-af16-c7f9c3a46e0e?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:themeperch:build_\&_control_block_pattern:*:*:*:*:*:wordpress:*:*
History

08 Jan 2025, 18:05

Type Values Removed Values Added
First Time Themeperch build \& Control Block Pattern
Themeperch
CPE cpe:2.3:a:themeperch:build_\&_control_block_pattern:*:*:*:*:*:wordpress:*:*
CWE CWE-862
References () https://plugins.trac.wordpress.org/browser/control-block-patterns/trunk/classes/Settings/SettingsPage.php#L166 - () https://plugins.trac.wordpress.org/browser/control-block-patterns/trunk/classes/Settings/SettingsPage.php#L166 - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/38f09a45-2b11-47c7-af16-c7f9c3a46e0e?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/38f09a45-2b11-47c7-af16-c7f9c3a46e0e?source=cve - Third Party Advisory

21 Nov 2024, 08:49

Type Values Removed Values Added
Summary
  • (es) El complemento Build & Control Block Patterns – Boost up Gutenberg Editor para WordPress es vulnerable al acceso no autorizado a los datos debido a una falta de verificación de capacidad en la función settings_export() en todas las versiones hasta la 1.3.5.4 incluida. Esto hace posible que atacantes no autenticados exporten la configuración del complemento.
References () https://plugins.trac.wordpress.org/browser/control-block-patterns/trunk/classes/Settings/SettingsPage.php#L166 - () https://plugins.trac.wordpress.org/browser/control-block-patterns/trunk/classes/Settings/SettingsPage.php#L166 -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/38f09a45-2b11-47c7-af16-c7f9c3a46e0e?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/38f09a45-2b11-47c7-af16-c7f9c3a46e0e?source=cve -

05 Mar 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-05 02:15

Updated : 2025-01-08 18:05

NVD link : CVE-2024-1095

Mitre link : CVE-2024-1095

CVE.ORG link : CVE-2024-1095

JSON object : View

Products Affected

themeperch

  • build_\&_control_block_pattern
CWE
CWE-862

Missing Authorization