Language Translate Widget for WordPress – ConveyThis < 235 – Missing Authorization to Limited Option Update | CVE 2024-38792 | Plugin Vulnerabilities

Description

The Language Translate Widget for WordPress – ConveyThis plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the /app/connect/ConveyThisStart.php file in versions up to, and including, 234. This makes it possible for unauthenticated attackers to update the api_key option in the database.

Affects Plugins

conveythis-translate

Fixed in 235

References

CVE

URL

https://www.wordfence.com/threat-intel/vulnerabilities/id/0505d023-a5b9-4c86-aa9b-57ce2335f127

Classification

Type

NO AUTHORISATION

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Humberto Castelo Branco

Verified

No

WPVDB ID

01c61e1b-a599-447b-ad3b-336755a2499e

Timeline

Publicly Published

2024-07-22 (about 2 years ago)

Added

2024-08-01 (about 2 years ago)

Last Updated

2024-08-01 (about 2 years ago)

Other

Published

Title

Published

2023-05-02

Title

WP Directory Kit < 1.2.3 - Unauthenticated Arbitrary Settings Update

Published

2025-11-20

Title

ELEX WordPress HelpDesk & Customer Ticketing System < 3.3.2 - Missing Authorization to Authenticated (Subscriber+) Role Removal

Published

2025-10-24

Title

Tutor LMS – eLearning and online course solution < 3.9.0 - Missing Authorization to Unauthenticated Payment Status Update

Published

2024-06-06

Title

Dashboard To-Do List < 1.3.0 - Missing Authorization via ardtdw_widgetsetup()

Published

2026-08-11

Title

Frontend Admin by DynamiApps < 3.29.10 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token