WordPress Plugin Vulnerabilities

Crelly Slider < 1.4.6 - Subscriber+ Insecure Direct Object Reference

Description

The plugin is vulnerable to Insecure Direct Object Reference due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
crelly-slider
Fixed in 1.4.6

References

CVE
CVE-2024-33542
URL
https://patchstack.com/database/wordpress/plugin/crelly-slider/vulnerability/wordpress-crelly-slider-plugin-1-4-5-insecure-direct-object-references-idor-vulnerability

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Steven Julian
Verified
No
WPVDB ID
14f80798-fe43-4c32-8247-5c575b6c4bf2

Timeline

Publicly Published
2024-04-25 (about 2 years ago)
Added
2024-05-01 (about 2 years ago)
Last Updated
2025-01-06 (about 1 year ago)

Other

Published
Title
Published
2025-02-03
Title
JS Help Desk – The Ultimate Help Desk & Support Plugin < 2.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-09-09
Title
Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover
Published
2022-10-21
Title
Quiz And Survey Master < 7.3.7 - Multiple Author+ IDOR
Published
2024-12-02
Title
WPCasa < 1.3.0 - Insecure Direct Object Reference
Published
2024-11-20
Title
UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) < 1.1.9 - Insecure Direct Object Reference to Sensitive Information Exposure via UA_Template Shortcode