WordPress Plugin Vulnerabilities

Sirv < 7.2.3 - Missing Authorization to Arbitrary Options Update

Description

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sirv_dismiss_notice() function in all versions up to, and including, 7.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options which could lead to privilege escalation.

Affects Plugins

Plugin icon
sirv
Fixed in 7.2.3

References

CVE
CVE-2024-32959
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1b94583f-405e-4fd3-849e-33563b72f698

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Emili Castells
Verified
No
WPVDB ID
8a1bc665-4f94-47ed-849e-395d5c43ad9e

Timeline

Publicly Published
2024-04-23 (about 2 years ago)
Added
2024-04-29 (about 2 years ago)
Last Updated
2024-04-29 (about 2 years ago)

Other

Published
Title
Published
2025-12-31
Title
Orders Chat for WooCommerce <= 1.2.0 - Missing Authorization
Published
2026-04-07
Title
WPAMS - Apartment Management System for wordpress < 49.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Published
2026-02-25
Title
DEPART < 1.0.8 - Missing Authorization
Published
2025-10-21
Title
Litho Addons <= 3.4 - Missing Authorization
Published
2026-06-05
Title
RSS Aggregator by Feedzy < 5.1.8 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions