WordPress Plugin Vulnerabilities

AyeCode Connect < 1.3.9 - Missing Authorization

Description

The AyeCode Connect plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the install_mu_plugin() function in versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to install must use plugins.

Affects Plugins

Plugin icon
ayecode-connect
Fixed in 1.3.9

References

CVE
CVE-2024-56255
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8b56fd35-377a-4d18-abf7-7946e5d4e21c

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Trương Hữu Phúc (truonghuuphuc)
Verified
No
WPVDB ID
266bb741-c7d7-4752-9274-ceac5558bd51

Timeline

Publicly Published
2024-12-30 (about 1 year ago)
Added
2025-01-08 (about 1 year ago)
Last Updated
2025-01-08 (about 1 year ago)

Other

Published
Title
Published
2025-04-23
Title
Reales WP - Real Estate WordPress Theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates
Published
2024-11-15
Title
Customer Reviews for WooCommerce < 5.62.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation
Published
2025-06-19
Title
WP Visitor Statistics (Real Time Traffic) < 8.5 - Missing Authorization
Published
2024-08-16
Title
Fonts < 3.7.8 - Missing Authorization
Published
2024-09-06
Title
Revision Manager TMC < 2.8.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending