CVE-2024-3915: Swift Framework <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update
The Swift Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sfeditdirectoryitem() function in all versions up to, and including, 2.7.31. This makes it possible for unauthenticated attackers to update arbitrary posts with arbitrary content. Unfortunately, we did not receive a response from the vendor to send over the vulnerability details.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3915?
CVE-2024-3915 has a high severity rating due to the potential for unauthorized data modification by unauthenticated attackers.
How do I fix CVE-2024-3915?
To fix CVE-2024-3915, update the Swift Framework plugin to version 2.7.32 or later, which includes the necessary capability checks.
What versions are affected by CVE-2024-3915?
CVE-2024-3915 affects all versions of the Swift Framework up to and including 2.7.31.
Who can exploit CVE-2024-3915?
CVE-2024-3915 can be exploited by unauthenticated attackers who can modify data within the Swift Framework.
What function is vulnerable in CVE-2024-3915?
The vulnerable function in CVE-2024-3915 is sf_edit_directory_item(), which lacks proper capability checks.