CVE-2024-4445

Description

The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit plugin settings, including storing cross-site scripting, in multisite environments.

Reserved 2024-05-02 | Published 2024-05-14 | Updated 2024-08-01 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

*
affected

Timeline

2024-05-13:

Disclosed

Credits

Lucio Sá finder

References

www.wordfence.com/...-da3b-4a95-99f1-c4a4c8e6944c?source=cve

plugins.trac.wordpress.org/...asses/mu.class.php?rev=2946135

plugins.trac.wordpress.org/changeset/3082085/

cve.org (CVE-2024-4445)

nvd.nist.gov (CVE-2024-4445)

Download JSON