WordPress Plugin Vulnerabilities

My Wp Brand – Hide menu & Hide Plugin < 1.1.3 - Missing Authorization

Description

The My Wp Brand – Hide menu & Hide Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mwb_plugins_form() and mwb_style_ajax() function in versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to modify settings.

Affects Plugins

Plugin icon
my-wp-brand
Fixed in 1.1.3

References

CVE
CVE-2024-49694
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee977de-4132-48c1-b751-fcea8d28f66b

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Verified
No
WPVDB ID
21e21b51-dd5f-4b30-9ded-290a828c525d

Timeline

Publicly Published
2024-10-21 (about 1 year ago)
Added
2024-10-30 (about 1 year ago)
Last Updated
2024-10-30 (about 1 year ago)

Other

Published
Title
Published
2025-01-06
Title
SMS Alert Order Notifications – WooCommerce < 3.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Published
2026-02-15
Title
WPLifeCycle < 4.0 - Missing Authorization
Published
2025-06-12
Title
Hydra Booking < 1.1.10 - Missing Authorization
Published
2025-11-14
Title
Woffice Core < 5.4.31 - Missing Authorization
Published
2026-04-20
Title
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress < 4.1133 - Missing Authorization