CVE-2024-1109: Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Export
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the initdownload() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracking data and podcast information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1109?
CVE-2024-1109 has a medium severity level due to potential unauthorized access to sensitive data.
How do I fix CVE-2024-1109?
To fix CVE-2024-1109, ensure you update the Podlove Podcast Publisher plugin to version 4.0.12 or later.
What could happen if I don't patch CVE-2024-1109?
If CVE-2024-1109 is not patched, unauthenticated attackers may exploit the vulnerability to gain unauthorized access to the plugin's data.
Which versions are affected by CVE-2024-1109?
CVE-2024-1109 affects all versions of the Podlove Podcast Publisher plugin up to and including 4.0.11.
Is user authentication required to exploit CVE-2024-1109?
No, exploitation of CVE-2024-1109 can be performed by unauthenticated attackers.