CVE-2024-0829: Comments Extra Fields For Post,Pages and CPT <= 5.0 - Missing Authorization
The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0. This is due to missing or incorrect capability checks on several ajax actions. This makes it possible for authenticated attackers, with subscriber access or higher, to invoke those actions. As a result, they may modify comment form fields and update plugin settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0829?
CVE-2024-0829 is classified as a moderate severity vulnerability.
How do I fix CVE-2024-0829?
To fix CVE-2024-0829, upgrade the Comments Extra Fields For Post, Pages and CPT plugin to version 5.1 or later.
Who is affected by CVE-2024-0829?
Users of the Comments Extra Fields For Post, Pages and CPT plugin for WordPress versions up to and including 5.0 are affected by CVE-2024-0829.
What does CVE-2024-0829 allow an attacker to do?
CVE-2024-0829 allows authenticated attackers to perform unauthorized actions due to missing capability checks.
Is there a workaround for CVE-2024-0829?
There is no official workaround for CVE-2024-0829; updating to the latest version is recommended.