CVE-2024-0434: WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_save
First published: Wed May 29 2024(Updated: )
The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ttbm_new_place_save' function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to create and publish new place posts. This function is also vulnerable to CSRF.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WP Travel | <=1.7.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e84d3e22-8568-4bdb-be9b-ffe78c69ec24?source=cve
- https://plugins.trac.wordpress.org/browser/tour-booking-manager/trunk/admin/settings/tour/TTBM_Settings_place_you_see.php#L225
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3092969%40tour-booking-manager%2Ftrunk&old=3091912%40tour-booking-manager%2Ftrunk&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-0434?
CVE-2024-0434 is considered a medium-severity vulnerability due to unauthorized modification of data.
How do I fix CVE-2024-0434?
To fix CVE-2024-0434, update the WpTravelly plugin to version 1.7.2 or later.
What versions of WpTravelly are affected by CVE-2024-0434?
CVE-2024-0434 affects all versions of the WpTravelly plugin up to and including version 1.7.1.
What kind of attacks can be carried out due to CVE-2024-0434?
CVE-2024-0434 can be exploited to perform unauthorized modifications of data within the WordPress site.
Is there a public exploit for CVE-2024-0434?
As of now, there is no publicly known exploit specifically targeting CVE-2024-0434.
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wordpress
- canonical/wp travel