5.3Orta

CVE-2024-7381Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution

creativform Geo Controller; wordpress geo_controller Yayım: 2024-09-05 14:00 (2 yıl önce)

Açıklama

The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.

Zayıflık türü (CWE): CWE-862

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
creativform	Geo Controller	≤ 8.6.9
wordpress	geo_controller	≤ 8.6.9

Kaynaklar ve yamalar

CVSS puanı

5.3Orta

Kaynak: Wordfence · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Düşük
Bütünlük: Yok
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS (30 günde istismar olasılığı)

0.34%

tüm CVE'lerin %27'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2024-08-01
Yayımlandı2024-09-05 14:00
IP-DB'ye ulaştı2026-10-24 23:57
Son güncelleme2026-04-08 19:51

Numarayı veren (CNA): Wordfence

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

Puansız

CVE-2026-118239 1 saat önce

AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback

AutomatorWP

The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert …

Puansız

CVE-2026-118188 1 saat önce

PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowin…

Puansız

CVE-2026-118187 1 saat önce

PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of tha…

Puansız

CVE-2026-118186 1 saat önce

PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed po…

Puansız

CVE-2026-118167 1 saat önce

MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override

MC4WP: Mailchimp for WordPress

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscri…

Puansız

CVE-2026-115673 1 saat önce

Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

Anti-Spam, Spam FireWall by CleanTalk

The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the …