WordPress Plugin Vulnerabilities

WordPress Tag Cloud Plugin – Tag Groups < 2.0.4 - Missing Authorization to Information Exposure

Description

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several REST APIs in all versions up to, and including, 2.0.3. This makes it possible for unauthenticated attackers to extract information about tags.

Affects Plugins

Plugin icon
tag-groups
Fixed in 2.0.4

References

CVE
CVE-2024-43237
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1cdfbc7a-e3c2-44c1-af83-b2b78be01e5e

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Peng Zhou
Verified
No
WPVDB ID
4d32fdc1-7a97-490e-a38d-b0121111f7b2

Timeline

Publicly Published
2024-09-12 (about 1 year ago)
Added
2024-09-18 (about 1 year ago)
Last Updated
2024-09-18 (about 1 year ago)

Other

Published
Title
Published
2024-05-22
Title
Atarim < 3.30 - Unauthenticated Settings Update, Post Deletion etc
Published
2025-09-05
Title
Gutentor <= 3.5.4 - Missing Authorization
Published
2026-06-23
Title
Generate Security.txt <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action
Published
2025-09-22
Title
CardCom Payment Gateway <= 3.5.0.5 - Missing Authorization
Published
2024-05-14
Title
WP Fundraising Donation and Crowdfunding Platform < 1.7.0 - Missing Authorization