CVE-2024-6579 - Web and WooCommerce Addons for WPBakery Builder <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification

Back Back to CVE browser

MEDIUM

Web and WooCommerce Addons for WPBakery Builder <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification

Published Jul 16, 2024

4.3

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress is vulnerable to unauthorized plugin settings modification due to a missing capability check on several plugin functions in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change some of the plugin settings.

Affected products

Vendor Genetechproducts Product Web and WooCommerce Addons for WPBakery Builder Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.4.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Genetechproducts

Web and WooCommerce Addons for WPBakery Builder

unaffected

Version	Status	Constraints
0	affected	<=1.4.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47649		Advisory
https://plugins.trac.wordpress.org/browser/vc-addons-by-bit14/tags/1.4.5/bit14-vc-addons.php#L102
https://plugins.trac.wordpress.org/browser/vc-addons-by-bit14/tags/1.4.5/bit14-vc-addons.php#L114
https://plugins.trac.wordpress.org/browser/vc-addons-by-bit14/tags/1.4.5/bit14-vc-addons.php#L125
https://www.wordfence.com/threat-intel/vulnerabilities/id/746b77c9-64f8-43e8-9c2a-ce6bc35fd24c?source=cve