WordPress Plugin Vulnerabilities

Hummingbird < 3.7.4 - Missing Authorization

Description

The Hummingbird plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /admin/class-ajax.php file in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to perform unauthorized actions like clearing cache.

Affects Plugins

Plugin icon
hummingbird-performance
Fixed in 3.7.4

References

CVE
CVE-2024-32792
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0bd35ef1-ed28-44db-a1f6-74bc83974c71

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Peng Zhou
Verified
No
WPVDB ID
009b4c3f-8c8e-4e9a-97cc-21503cec3dbe

Timeline

Publicly Published
2024-04-22 (about 2 years ago)
Added
2024-05-03 (about 2 years ago)
Last Updated
2024-05-03 (about 2 years ago)

Other

Published
Title
Published
2024-09-05
Title
Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin < 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Published
2024-01-08
Title
Envira Gallery Lite < 1.8.7.3 - Missing Authorization to Gallery Modification via envira_gallery_insert_images
Published
2024-01-31
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.7 - Missing Authorization via set_starred()
Published
2024-12-22
Title
Client Invoicing by Sprout Invoices – Easy Estimates and Invoices < 20.8.2 - Missing Authorization
Published
2025-02-17
Title
GetBookingsWp - Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover