WordPress Plugin Vulnerabilities

WPSSO Core < 18.18.2 - Missing Authorization

Description

The WPSSO Core – Complete and Optimized Structured Data SEO plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 18.18.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
wpsso
Fixed in 18.18.2

References

CVE
CVE-2024-56243
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/94e6118a-5950-481a-92f3-f25e01f186d7

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Jingle Bells
Verified
No
WPVDB ID
9366f442-8491-4a36-ab97-e0fe4d2fc70f

Timeline

Publicly Published
2024-12-30 (about 1 year ago)
Added
2025-01-08 (about 1 year ago)
Last Updated
2025-01-08 (about 1 year ago)

Other

Published
Title
Published
2025-07-03
Title
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function
Published
2023-12-21
Title
Paid Memberships Pro < 2.12.6 - Missing Authorization via API
Published
2026-01-05
Title
ilGhera Support System for WooCommerce < 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Deletion
Published
2026-01-05
Title
Depicter Slider < 4.0.5 - Missing Authorization
Published
2025-12-18
Title
Adminify < 4.0.7 - Missing Authorization