CVE-2024-12249: GS Insever Portfolio <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection
The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings() function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's CSS settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12249?
CVE-2024-12249 is a medium severity vulnerability that allows unauthorized modification of settings.
How do I fix CVE-2024-12249?
To fix CVE-2024-12249, update the GS Insever Portfolio plugin to version 1.4.6 or later.
Who is affected by CVE-2024-12249?
Authenticated users with Subscriber-level access in versions up to 1.4.5 of the GS Insever Portfolio plugin are affected by CVE-2024-12249.
What does CVE-2024-12249 exploit?
CVE-2024-12249 exploits a missing capability check in the save_settings() function.
Is CVE-2024-12249 being actively exploited?
At this time, there have been no confirmed reports of active exploitation of CVE-2024-12249.