CVE-2024-1352
First published: Tue Apr 09 2024(Updated: )
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtcl_import_location() rtcl_import_category() functions in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create terms.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| RadiusTheme Classified Listing | <3.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f5da4cdd-15c7-41a6-be2f-e31bd407ae05?source=cve
- https://plugins.trac.wordpress.org/browser/classified-listing/trunk/app/Controllers/Ajax/Import.php?rev=2824166
- https://plugins.trac.wordpress.org/browser/classified-listing/trunk/app/Controllers/Ajax/Import.php?rev=3061893
Frequently Asked Questions
What is the severity of CVE-2024-1352?
CVE-2024-1352 is considered a high severity vulnerability due to unauthorized access and data modification risks.
How do I fix CVE-2024-1352?
To fix CVE-2024-1352, update the Classified Listing plugin to version 3.0.5 or later to ensure proper capability checks.
What versions of the Classified Listing plugin are affected by CVE-2024-1352?
CVE-2024-1352 affects all versions of the Classified Listing plugin for WordPress up to and including 3.0.4.
What functions are vulnerable in CVE-2024-1352?
The functions rtcl_import_location() and rtcl_import_category() are vulnerable in CVE-2024-1352 due to missing capability checks.
Can CVE-2024-1352 be exploited remotely?
Yes, CVE-2024-1352 can be exploited remotely by attackers to gain unauthorized access and modify data.
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/radiustheme
- canonical/radiustheme classified listing