WordPress Plugin Vulnerabilities

Widget Options < 4.0.8 - Missing Authorization

Description

The Widget Options plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the widgetopts_save_widget_editor_cache() function in versions up to, and including, 4.0.6.1. This makes it possible for authenticated attackers, with contributor-level access and above, to save caches.

Affects Plugins

Plugin icon
widget-options
Fixed in 4.0.8

References

CVE
CVE-2024-56219
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ccbf6d57-44ba-4064-8880-81cd9136ca33

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
4e7ed2b1-5447-4784-84ed-cf91d66ab2d8

Timeline

Publicly Published
2024-12-19 (about 1 year ago)
Added
2025-01-08 (about 1 year ago)
Last Updated
2025-01-08 (about 1 year ago)

Other

Published
Title
Published
2024-10-09
Title
QA Analytics < 4.1.1.2 - Unauthenticated Settings Update
Published
2024-12-14
Title
Torod – The smart shipping and delivery portal for e-shops and retailers < 1.8 - Missing Authorization to Unauthenticated Plugin Settings Update
Published
2025-05-15
Title
Jetpack Debug Tools < 2.0.1 - Missing Authorization
Published
2024-08-09
Title
Persian WooCommerce < 9.0.0 - Missing Authorization
Published
2025-03-31
Title
CF7 Spreadsheets <= 2.3.2 - Missing Authorization to Settings Update