CVE-2024-3663: WP Scraper <= 5.7 - Missing Authorization to Arbitrary Page/Post Creation
The WP Scraper plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpscrapermultiscrapeaction() function in all versions up to, and including, 5.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary pages and posts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3663?
CVE-2024-3663 has a medium severity rating due to the potential for unauthorized access.
How do I fix CVE-2024-3663?
To fix CVE-2024-3663, update the WP Scraper plugin to the latest version beyond 5.7 or implement capability checks in the wp_scraper_multi_scrape_action() function.
Who is affected by CVE-2024-3663?
CVE-2024-3663 affects users of the WP Scraper plugin for WordPress versions up to and including 5.7.
What type of vulnerability is CVE-2024-3663?
CVE-2024-3663 is an unauthorized access vulnerability due to a missing capability check.
Can authenticated attackers exploit CVE-2024-3663?
Yes, authenticated attackers with subscriber-level access can exploit CVE-2024-3663 to gain unauthorized access.