WordPress Plugin Vulnerabilities

Featured Image from URL < 4.8.3 - Missing Authorization

Description

The Featured Image from URL plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the fifu_get_private_data_permissions_check() function in versions up to, and including, 4.8.2. This makes it possible for authenticated attackers, with contributor-level access and above, to utilize several REST API endpoints.

Affects Plugins

Plugin icon
featured-image-from-url
Fixed in 4.8.3

References

CVE
CVE-2024-37516
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/88fb7e43-26b1-44e4-864a-e6bd6f2c48fa

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
16a395d8-a042-4c99-963f-83e4cb908572

Timeline

Publicly Published
2024-07-05 (about 1 year ago)
Added
2024-07-10 (about 1 year ago)
Last Updated
2024-07-10 (about 1 year ago)

Other

Published
Title
Published
2025-05-16
Title
CSS3 Accordions for WordPress < 3.1 - Missing Authorization
Published
2025-02-19
Title
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) < 4.5.0 - Missing Authorization to Unauthenticated Price, Date, and Note Updates
Published
2023-11-13
Title
WP Custom Admin Interface < 7.32 - Missing Authorization via wpcai_pro_notice_disable
Published
2023-08-24
Title
Premmerce User Roles < 1.0.13 - Missing Authorization via role management functions
Published
2024-03-29
Title
Move Addons for Elementor < 1.3.0 - Missing Authorization