WordPress Plugin Vulnerabilities

Raptive Ads < 3.7.1 - Missing Authorization to Unauthenticated Data/Settings Reset

Description

The Raptive Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the site_ads_files_reset() and cls_file_reset() functions in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to reset the ad and cls files.

Affects Plugins

Plugin icon
adthrive-ads
Fixed in 3.7.1

References

CVE
CVE-2024-13364
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7a08d857-c8be-4ba8-b9fb-eed222a8cd8c

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Tieu Pham Trong Nhan
Verified
No
WPVDB ID
10a3d7eb-c2bd-4d96-b85b-5803793dc9bb

Timeline

Publicly Published
2025-02-18 (about 1 year ago)
Added
2025-02-18 (about 1 year ago)
Last Updated
2025-03-13 (about 1 year ago)

Other

Published
Title
Published
2026-06-18
Title
STRABL < 4.6 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Template Kit Import
Published
2023-10-25
Title
kk Star Ratings < 5.4.6 - Missing Authorization
Published
2026-03-13
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.10 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license
Published
2025-03-31
Title
ELEX WooCommerce Request a Quote <= 2.3.9 - Missing Authorization