CVE-2024-9025: Sight – Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title
First published: Thu Sep 26 2024(Updated: )
The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to expose private, pending, trashed, and draft post titles. Successful exploitation requires the Elementor plugin to be installed and activated.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress | <1.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-9025?
CVE-2024-9025 is considered to have a high severity due to its potential for unauthorized data access.
How do I fix CVE-2024-9025?
To fix CVE-2024-9025, update the Sight – Professional Image Gallery and Portfolio plugin for WordPress to version 1.1.3 or later.
What versions are affected by CVE-2024-9025?
CVE-2024-9025 affects all versions of the Sight plugin up to and including version 1.1.2.
Who is affected by CVE-2024-9025?
Users of the Sight – Professional Image Gallery and Portfolio plugin for WordPress versions up to 1.1.2 are at risk from CVE-2024-9025.
What type of vulnerability is CVE-2024-9025?
CVE-2024-9025 is a vulnerability related to missing capability checks, leading to unauthorized access to data.
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/trending
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/codesupply
- canonical/wordpress