WordPress Plugin Vulnerabilities

SecuPress Free < 2.3 - Missing Authorization

Description

The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.2.5.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
secupress
Fixed in 2.3

References

CVE
CVE-2024-43228
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/81cc4ef1-6303-4ecd-8b51-2602ddd74ece

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Verified
No
WPVDB ID
097b870b-80e7-4ec8-a67c-36d6e8b60e72

Timeline

Publicly Published
2025-03-11 (about 1 year ago)
Added
2025-03-17 (about 1 year ago)
Last Updated
2025-03-17 (about 1 year ago)

Other

Published
Title
Published
2024-07-26
Title
Tutor LMS – Migration Tool <= 2.2.2 - Missing Authorization in tutor_lp_export_xml
Published
2024-05-03
Title
SimpleShop < 2.10.3 - Missing Authorization
Published
2025-12-11
Title
Premmerce Brands for WooCommerce < 1.2.14 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update
Published
2024-03-28
Title
Finale Lite < 2.18.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation
Published
2024-06-03
Title
Integrate Google Drive < 1.3.94 - Missing Authorization