CVE-2024-5665: Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘exportsettings’ function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary options on affected sites.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5665?
The severity of CVE-2024-5665 is classified as high due to the potential for unauthorized data access.
How do I fix CVE-2024-5665?
To fix CVE-2024-5665, update the Login/Signup Popup plugin for WordPress to version 2.7.3 or later.
Who is affected by CVE-2024-5665?
CVE-2024-5665 affects users of the Login/Signup Popup plugin for WordPress versions 2.7.1 to 2.7.2.
What type of vulnerability is CVE-2024-5665?
CVE-2024-5665 is an unauthorized data access vulnerability caused by a missing capability check.
What can an attacker do with CVE-2024-5665?
An attacker can exploit CVE-2024-5665 to access and export settings without proper authorization.