CVE-2024-5545: Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization
The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stmeditdeleteusercar function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to unpublish arbitrary posts and pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Motors – Car Dealer, Classifieds & Listingto a version that resolves this vulnerability.Fixed in 1.4.9 - Compensating control
Ensure unauthenticated users cannot reach the affected WordPress functionality (the stm_edit_delete_user_car capability check issue) until the plugin is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5545?
CVE-2024-5545 is considered a high severity vulnerability due to the potential for unauthorized data modification.
How do I fix CVE-2024-5545?
To fix CVE-2024-5545, update the Motors – Car Dealer, Classifieds & Listing plugin to version 1.4.9 or higher.
Who is affected by CVE-2024-5545?
CVE-2024-5545 affects all versions of the Motors – Car Dealer, Classifieds & Listing plugin for WordPress up to and including version 1.4.8.
What function is vulnerable in CVE-2024-5545?
The stm_edit_delete_user_car function is vulnerable in CVE-2024-5545 due to a missing capability check.
Can CVE-2024-5545 be exploited by unauthenticated users?
Yes, CVE-2024-5545 can be exploited by unauthenticated users, allowing them to modify data without authorization.