WordPress Plugin Vulnerabilities

Sliced Invoices < 3.9.3 - Missing Authorization

Description

The Sliced Invoices plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sure_to_email() function in versions up to, and including, 3.9.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails.

Affects Plugins

Plugin icon
sliced-invoices
Fixed in 3.9.3

References

CVE
CVE-2024-30517
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c17d7fba-7b98-4a7a-a35e-78f16be81aca

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Lucio Sá
Verified
No
WPVDB ID
038fc71c-5970-4a2d-b1a8-92594589f4ed

Timeline

Publicly Published
2024-03-28 (about 2 years ago)
Added
2024-04-03 (about 2 years ago)
Last Updated
2024-04-03 (about 2 years ago)

Other

Published
Title
Published
2026-01-15
Title
All in One SEO < 4.9.3 - Contributor+ AI Access Token and Credit Disclosure
Published
2024-05-29
Title
Comparison Slider <= 1.0.5 - Missing Authorization
Published
2026-04-20
Title
Responsive Blocks < 2.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via AJAX Actions
Published
2023-12-27
Title
FunnelKit Checkout < 3.11.0 - Subscriber+ Arbitrary Plugin Activation
Published
2024-03-19
Title
Advanced Classifieds & Directory Pro < 3.1.2 - Missing Authorization to Arbitrary Attachment Deletion