CVE-2024-2505: GamiPress < 6.8.9 - Broken Access Control
The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requests and extend access to lower privileged users, like Subscribers, despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical GamiPress WordPress plugin before 6.8.9 configurations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2505?
CVE-2024-2505 is classified as a high severity vulnerability due to its impact on access control.
How do I fix CVE-2024-2505?
To fix CVE-2024-2505, update the GamiPress plugin to version 6.8.9 or later.
What are the potential impacts of CVE-2024-2505?
CVE-2024-2505 allows lower privileged users, such as Subscribers, to gain unauthorized access to settings intended for Authors.
Who is affected by CVE-2024-2505?
CVE-2024-2505 affects GamiPress WordPress plugin versions prior to 6.8.9.
What versions of GamiPress are vulnerable to CVE-2024-2505?
GamiPress versions before 6.8.9 are vulnerable to CVE-2024-2505.