CVE-2024-10861

Description

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to update the 'ays_pb_upgrade_plugin' option with arbitrary data.

PUBLISHED Reserved 2024-11-05 | Published 2024-11-16 | Updated 2024-11-19 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

Trương Hữu Phúc (truonghuuphuc) finder

References

www.wordfence.com/...-9a18-48a1-97d3-1d41c7f93261?source=cve

plugins.trac.wordpress.org/...2/admin/class-ays-pb-admin.php

plugins.trac.wordpress.org/...admin%2Fclass-ays-pb-admin.php

cve.org (CVE-2024-10861)

nvd.nist.gov (CVE-2024-10861)

Download JSON