CVE-2024-6392: Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update
First published: Thu Jul 11 2024(Updated: )
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sirv CDN | <7.2.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-6392?
CVE-2024-6392 is considered a medium severity vulnerability due to unauthorized settings modification risk.
How do I fix CVE-2024-6392?
To fix CVE-2024-6392, update the Sirv plugin for WordPress to version 7.2.8 or higher.
Who is affected by CVE-2024-6392?
CVE-2024-6392 affects all versions of the Sirv plugin for WordPress up to and including version 7.2.7.
What type of vulnerability is CVE-2024-6392?
CVE-2024-6392 is a vulnerability that allows unauthorized modification of plugin settings due to missing capability checks.
How can an attacker exploit CVE-2024-6392?
An attacker can exploit CVE-2024-6392 by gaining authenticated access and modifying plugin settings without proper authorization.
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/sirv
- canonical/sirv cdn