WordPress Plugin Vulnerabilities

PropertyHive < 2.0.10 - Missing Authorization

Description

The PropertyHive plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in versions up to, and including, 2.0.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify notes.

Affects Plugins

Plugin icon
propertyhive
Fixed in 2.0.10

References

CVE
CVE-2024-37204
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b8fe4fe5-2b13-4001-a177-0d182aa2af30

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
CatFather
Verified
No
WPVDB ID
2cc4e7e6-4b25-4029-9fd3-1b4039323221

Timeline

Publicly Published
2024-06-20 (about 2 years ago)
Added
2024-07-02 (about 2 years ago)
Last Updated
2024-07-02 (about 2 years ago)

Other

Published
Title
Published
2024-06-17
Title
Tickera < 3.5.2.9 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion
Published
2026-01-19
Title
Ecwid Shopping Cart < 7.0.6 - Missing Authorization
Published
2026-05-21
Title
FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation
Published
2026-03-24
Title
WPGraphQL < 2.10 - Missing Authorization
Published
2023-11-14
Title
Thrive Theme Builder < 3.24.0 - Missing Authorization