CVE-2024-4874: Bricks Builder <= 1.9.8 - Insecure Direct Object Reference
The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify posts and pages created by other users including admins. As a requirement for this, an admin would have to enable access to the editor specifically for such a user or enable it for all users with a certain user account type.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4874?
CVE-2024-4874 is considered a high severity vulnerability due to its potential for exploitation by authenticated attackers.
How do I fix CVE-2024-4874?
To fix CVE-2024-4874, update the Bricks Builder plugin to version 1.9.9 or later.
Who is affected by CVE-2024-4874?
CVE-2024-4874 affects all versions of the Bricks Builder plugin for WordPress up to and including 1.9.8.
What type of vulnerability is CVE-2024-4874?
CVE-2024-4874 is categorized as an Insecure Direct Object Reference vulnerability.
Can any user exploit CVE-2024-4874?
Only authenticated users with Contributor-level access can exploit CVE-2024-4874.