IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
5.3Orta

CVE-2024-1047ThemeIsle SDK <= Various Versions - Missing Authorization

themeisle Menu Icons by ThemeIsle; themeisle Starter Sites & Templates by Neve; themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & … Yayım: (2 yıl önce)

Açıklama

Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.

Zayıflık türü (CWE): CWE-862

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
optimole Optimole – Optimize Images in Real Time ≤ 3.12.4
optimole Super Page Cache ≤ 4.7.5
rsocial Revive Social – Social Media Auto Post and Scheduling Automation Plugin ≤ 9.0.25
themeisle LightStart – Maintenance Mode, Coming Soon and Landing Page Builder ≤ 2.6.9
themeisle Menu Icons by ThemeIsle ≤ 0.13.8
themeisle Multiple Page Generator Plugin – MPG ≤ 3.4.0
themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More ≤ 2.10.28
themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE ≤ 2.6.2
themeisle PPOM – Product Addons & Custom Fields for WooCommerce ≤ 32.0.9
themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator ≤ 4.4.1
themeisle Starter Sites & Templates by Neve ≤ 1.2.6
themeisle Visualizer: Tables and Charts Manager for WordPress ≤ 3.10.6

Kaynaklar ve yamalar

Aynı üründe son açıklar — WordPress plugins & themes

7.1Yüksek
CVE-2026-124969

Optimole <= 4.2.19 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via 'comment_content'/'comment_agent' Parameter during Attachment Rename

optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the replace_urls_in_value function in all versions up to, and…

9.8Kritik
CVE-2026-126173

AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field

AutomatorWP AutomatorWP Webhooks

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible …