CVE-2024-6591
Description
The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.
CWE
- CWE-862 — CWE-862 Missing Authorization
Affected
- nitesh_singh / Ultimate WordPress Auction Plugin — v=0 ≤4.2.7 [affected]
CVSS
- 3.1 score=5.8 severity=MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/534a5d1d-cc34-4d84-b3a3-bf2282718656?source=cve
- https://plugins.trac.wordpress.org/changeset/3132812/ultimate-auction/trunk/ultimate-auction.php
Source
cvelistV5-main/cves/2024/6xxx/CVE-2024-6591.json