CVE-2024-0791: WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Missing Authorization
The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on the wpbecreatenewterm, wpbeupdatetaxterm, and wpbedeletetaxterm functions in all versions up to, and including, 1.0.8.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create, delete or modify taxonomy terms.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0791?
CVE-2024-0791 is considered a high severity vulnerability due to the potential for unauthorized access and data manipulation.
How do I fix CVE-2024-0791?
To fix CVE-2024-0791, update the WOLF – WordPress Posts Bulk Editor and Manager Professional plugin to the latest version that includes the necessary capability checks.
What versions of the WOLF plugin are affected by CVE-2024-0791?
All versions of the WOLF – WordPress Posts Bulk Editor and Manager Professional plugin up to and including 1.0.8.1 are affected by CVE-2024-0791.
What are the consequences of exploiting CVE-2024-0791?
Exploiting CVE-2024-0791 can lead to unauthorized access, modification, or loss of data within the WordPress site.
Is there a workaround for CVE-2024-0791 if I cannot update immediately?
As a temporary workaround for CVE-2024-0791, you can limit access to the WOLF plugin features until a patch is applied.