CVE-2024-4088: Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.2 - Missing Authorization
First published: Wed Jun 05 2024(Updated: )
The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable_fe_assets function in all versions up to, and including, 1.9.2. This makes it possible for authenticated attackers, with subscriber access or above, to change the plugin's settings. Additionally, no nonce check is performed resulting in a CSRF vulnerability.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WP Attire Attire Blocks | <1.9.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4088?
CVE-2024-4088 has a medium severity level due to the potential for unauthorized data modification.
How do I fix CVE-2024-4088?
To fix CVE-2024-4088, update the Gutenberg Blocks and Page Layouts – Attire Blocks plugin to version 1.9.3 or later.
Who is affected by CVE-2024-4088?
All users of the Attire Blocks plugin for WordPress up to and including version 1.9.2 are affected by CVE-2024-4088.
What can happen if CVE-2024-4088 is exploited?
If CVE-2024-4088 is exploited, an authenticated user could modify data without proper authorization.
Does CVE-2024-4088 affect other plugins or software?
CVE-2024-4088 specifically affects the Gutenberg Blocks and Page Layouts – Attire Blocks plugin and does not impact other plugins.
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wpattire
- canonical/wp attire attire blocks