WordPress Plugin Vulnerabilities

Announcer – Notification & message bars < 6.0.1 - Missing Authorization

Description

The Announcer – Notification & message bars plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the admin_ajax() function in versions up to, and including, 6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update some settings.

Affects Plugins

Plugin icon
announcer
Fixed in 6.0.1

References

CVE
CVE-2024-31261
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5981209b-5dc7-4823-bd90-2f9514beb616

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Abdi Pranata
Verified
No
WPVDB ID
9f2f5582-2c9e-461f-887d-21b185d702e1

Timeline

Publicly Published
2024-04-05 (about 2 years ago)
Added
2024-04-10 (about 2 years ago)
Last Updated
2024-04-10 (about 2 years ago)

Other

Published
Title
Published
2025-07-24
Title
Frontend File Manager < 22.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Published
2024-06-19
Title
Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer < 1.1.1 - Missing Authorization
Published
2026-02-03
Title
Magic Import Document Extractor < 1.0.6 - Missing Authorization to Unauthenticated Plugin License Status Modification
Published
2024-01-03
Title
Void Contact Form 7 Widget For Elementor Page Builder < 2.4 - Missing Authorization
Published
2026-03-23
Title
WPCargo Track & Trace <= 8.0.2 - Missing Authorization