CVE-2024-7605

Description

The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' function in all versions up to, and including, 1.1.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to update plugin options, potentially disrupting the service.

PUBLISHED Reserved 2024-08-08 | Published 2024-09-05 | Updated 2024-09-05 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

Peter Thaleikis finder

References

www.wordfence.com/...-0e5d-45d1-9db6-6ac426874762?source=cve

plugins.trac.wordpress.org/...min/class-hello-asso-admin.php

plugins.trac.wordpress.org/changeset/3145151/

cve.org (CVE-2024-7605)

nvd.nist.gov (CVE-2024-7605)

Download JSON