CVE-2024-13687: Team Builder – Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveteambuilderoptions() function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13687?
CVE-2024-13687 is considered a medium severity vulnerability due to its ability to allow unauthorized modification of data.
How do I fix CVE-2024-13687?
To fix CVE-2024-13687, update the Team Builder – Meet the Team plugin to version 1.4 or later, which includes the necessary capability checks.
Who is affected by CVE-2024-13687?
All versions of the Team Builder – Meet the Team plugin for WordPress up to and including version 1.3 are affected by CVE-2024-13687.
What kind of attack is related to CVE-2024-13687?
CVE-2024-13687 allows authenticated attackers to modify saved options in the plugin without proper authorization.
Is CVE-2024-13687 specific to any WordPress version?
CVE-2024-13687 is not specific to any WordPress version but rather affects the Team Builder – Meet the Team plugin itself.