CVE-2024-13776: ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsapdeletenotice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. There are several other functions also vulnerable to missing authorization.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13776?
CVE-2024-13776 has been classified as a high severity vulnerability due to the potential for unauthorized data modification.
How do I fix CVE-2024-13776?
To fix CVE-2024-13776, update the ZoomSounds WordPress Wave Audio Player with Playlist plugin to version 6.9.1 or higher.
What kind of attack can CVE-2024-13776 facilitate?
CVE-2024-13776 can facilitate a denial of service attack due to the vulnerability in the AJAX action for deleting notices.
Which versions are affected by CVE-2024-13776?
All versions of the ZoomSounds WordPress Wave Audio Player with Playlist plugin up to and including version 6.9 are affected by CVE-2024-13776.
Is user authentication sufficient to mitigate CVE-2024-13776?
No, user authentication alone is not sufficient to mitigate CVE-2024-13776 due to the missing capability check in the vulnerable AJAX action.