CVE-2024-13318: Essential WP Real Estate <= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion
The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cldeletelistingfunc() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13318?
CVE-2024-13318 is considered a high severity vulnerability due to the potential for unauthorized access and deletion of arbitrary pages.
How do I fix CVE-2024-13318?
To fix CVE-2024-13318, update the Essential WP Real Estate plugin to version 1.1.4 or later.
What versions of Essential WP Real Estate are affected by CVE-2024-13318?
CVE-2024-13318 affects all versions up to and including 1.1.3 of the Essential WP Real Estate plugin.
Who can exploit CVE-2024-13318?
CVE-2024-13318 can be exploited by unauthenticated attackers due to the lack of proper capability checks.
What impact does CVE-2024-13318 have on WordPress sites?
CVE-2024-13318 allows attackers to delete arbitrary listings from a WordPress site using the Essential WP Real Estate plugin, potentially disrupting business operations.