CVE-2024-6392: Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6392?
CVE-2024-6392 is considered a medium severity vulnerability due to unauthorized settings modification risk.
How do I fix CVE-2024-6392?
To fix CVE-2024-6392, update the Sirv plugin for WordPress to version 7.2.8 or higher.
Who is affected by CVE-2024-6392?
CVE-2024-6392 affects all versions of the Sirv plugin for WordPress up to and including version 7.2.7.
What type of vulnerability is CVE-2024-6392?
CVE-2024-6392 is a vulnerability that allows unauthorized modification of plugin settings due to missing capability checks.
How can an attacker exploit CVE-2024-6392?
An attacker can exploit CVE-2024-6392 by gaining authenticated access and modifying plugin settings without proper authorization.