CVE-2024-3607 - PropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

Back Back to CVE browser

MEDIUM

PropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

Published May 2, 2024

4.3

MEDIUM

CVSS 3.1

EPSS 0.61%

Description

The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() function in all versions up to, and including, 2.0.12. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts

Affected products

Vendor Propertyhive Product Property Hive Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=2.0.12

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Propertyhive

Property Hive

unaffected

Version	Status	Constraints
0	affected	<=2.0.12

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

Link	Providers	Tags
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3075163%40propertyhive&new=3075163%40propertyhive&sfp_email=&sfph_mail=#file11		Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d52ced-807b-48c0-bb7a-e40d143ae5d3?source=cve		Third Party Advisory