WordPress Plugin Vulnerabilities

Oxygen Builder < 4.9 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update

Description

The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update stylesheets.

Affects Plugins

Plugin icon
oxygenbuilder
Fixed in 4.9

References

CVE
CVE-2024-6688
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/78c88402-52ca-44ff-8767-1f843fcb66fd

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Francesco Carlucci
Verified
No
WPVDB ID
3176417f-d3fe-42e1-877b-391dd6bcfd32

Timeline

Publicly Published
2024-08-26 (about 1 year ago)
Added
2024-08-26 (about 1 year ago)
Last Updated
2024-08-27 (about 1 year ago)

Other

Published
Title
Published
2026-03-16
Title
Admin Safety Guard — Login Security & 2FA <= 1.2.6 - Missing Authorization
Published
2024-04-25
Title
EPROLO Dropshipping < 1.7.2 - Missing Authorization
Published
2024-08-28
Title
WP Accessibility Helper < 0.6.2.9 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
Published
2024-06-17
Title
Ibtana - WordPress Website Builder < 1.2.3.4 - Unauthenticated reCAPTCHA Settings Update
Published
2025-08-14
Title
Neon Channel Product Customizer Free < 3.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion