CVE-2024-6489: Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getgoogleapikey function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the MailChimp API key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/getwid-gutenberg-blocksto a version that resolves this vulnerability.Fixed in 2.0.10 - Configuration
Ensure get_google_api_key performs a proper capability check so that users with only Contributor-level access (or below the intended capability) cannot set or update the MailChimp/Google API key. The vulnerability exists in all versions up to and including 2.0.10 due to a missing capability check on get_google_api_key.
Getwid – Gutenberg Blocks (WordPress plugin) Capability check on get_google_api_key = enforce required capability before allowing API key update
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6489?
CVE-2024-6489 is classified as a medium severity vulnerability due to the potential for unauthorized data modification.
How do I fix CVE-2024-6489?
To fix CVE-2024-6489, upgrade the Getwid – Gutenberg Blocks plugin to version 2.0.11 or higher, which addresses the missing capability check.
Who is affected by CVE-2024-6489?
CVE-2024-6489 affects all versions of the Getwid – Gutenberg Blocks plugin for WordPress up to and including version 2.0.10.
Can CVE-2024-6489 be exploited remotely?
Yes, CVE-2024-6489 can be exploited by authenticated attackers with Contributor-level access to modify data unauthorizedly.
What function is vulnerable in CVE-2024-6489?
The function get_google_api_key is vulnerable in CVE-2024-6489 due to a missing capability check.