CVE-2024-1352: Classified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorization
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtclimportlocation() rtclimportcategory() functions in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create terms.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1352?
CVE-2024-1352 is considered a high severity vulnerability due to unauthorized access and data modification risks.
How do I fix CVE-2024-1352?
To fix CVE-2024-1352, update the Classified Listing plugin to version 3.0.5 or later to ensure proper capability checks.
What versions of the Classified Listing plugin are affected by CVE-2024-1352?
CVE-2024-1352 affects all versions of the Classified Listing plugin for WordPress up to and including 3.0.4.
What functions are vulnerable in CVE-2024-1352?
The functions rtcl_import_location() and rtcl_import_category() are vulnerable in CVE-2024-1352 due to missing capability checks.
Can CVE-2024-1352 be exploited remotely?
Yes, CVE-2024-1352 can be exploited remotely by attackers to gain unauthorized access and modify data.