CVE-2024-7380 - Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion

Back Back to CVE browser

MEDIUM

Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion

Published Sep 5, 2024

4.3

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and ajax__geolocate_remove_menu functions in all versions up to, and including, 8.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete WordPress menus.

Affected products

Vendor Creativform Product Geo Controller Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=8.7.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Creativform

Geo Controller

unaffected

Version	Status	Constraints
0	affected	<=8.7.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48316		Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3156125%40cf-geoplugin&new=3156125%40cf-geoplugin&sfp_email=&sfph_mail=#file503
https://www.wordfence.com/threat-intel/vulnerabilities/id/280e1b4d-08be-4e77-abcb-5f9079111595?source=cve		Third Party Advisory