The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality.
References
Configurations
History
02 Oct 2024, 17:00
Type | Values Removed | Values Added |
---|---|---|
References | () https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.0.8/src/AjaxHandler.php#L317 - Product | |
References | () https://plugins.trac.wordpress.org/changeset/3157424/#file17 - Patch | |
References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/3acaedff-f616-4b66-9208-f7e6a4df920d?source=cve - Third Party Advisory | |
First Time |
Wpchill
Wpchill download Monitor |
|
CPE | cpe:2.3:a:wpchill:download_monitor:*:*:*:*:*:wordpress:*:* |
26 Sep 2024, 13:32
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
26 Sep 2024, 03:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-09-26 03:15
Updated : 2024-10-02 17:00
NVD link : CVE-2024-8552
Mitre link : CVE-2024-8552
CVE.ORG link : CVE-2024-8552
JSON object : View
Products Affected
wpchill
- download_monitor
CWE
CWE-862
Missing Authorization