CVE-2024-2543: Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'geturieditor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2543?
CVE-2024-2543 is considered a medium severity vulnerability due to its potential for unauthorized access to sensitive data.
How do I fix CVE-2024-2543?
To fix CVE-2024-2543, update the Permalink Manager Lite plugin to version 2.4.3.2 or later.
Who is affected by CVE-2024-2543?
CVE-2024-2543 affects all versions of the Permalink Manager Lite plugin for WordPress up to and including 2.4.3.1.
What kind of access does CVE-2024-2543 allow attackers?
CVE-2024-2543 allows unauthenticated attackers to view the permalinks of all posts due to a missing capability check.
Is CVE-2024-2543 being actively exploited?
There is no public information indicating active exploitation of CVE-2024-2543, but it poses a risk if not addressed.