WordPress Plugin Vulnerabilities

weMail < 1.14.3 - Missing Authorization to Notice Dismissal

Description

The weMail plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the connect_notice() function in versions up to, and including, 1.14.2. This makes it possible for unauthenticated attackers to dismiss notices.

Affects Plugins

Plugin icon
wemail
Fixed in 1.14.3

References

CVE
CVE-2024-34822
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f7df2f38-4831-4cd4-b8ff-27c471775cae

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Dhabaleshwar Das
Verified
No
WPVDB ID
84102361-f0a2-4e13-b7d3-58de28b5e854

Timeline

Publicly Published
2024-05-15 (about 2 years ago)
Added
2024-05-15 (about 2 years ago)
Last Updated
2024-05-15 (about 2 years ago)

Other

Published
Title
Published
2025-01-16
Title
Loginplus <= 1.2 - Missing Authorization
Published
2025-07-22
Title
LoginWP - Pro < 4.0.8.6 - Missing Authorization to Unauthenticated Settings Update
Published
2024-07-04
Title
Zephyr Project Manager < 3.3.99 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
Published
2025-11-18
Title
Eagle Booking <= 1.3.4.3 - Missing Authorization to Authenticated (Subscriber+) Settings Change
Published
2024-04-22
Title
Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! < 2.1.3 - Missing Authorization to Subscriber+ Arbitrary Post Creation