WordPress Plugin Vulnerabilities

Word Replacer Pro <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content Update

Description

The Word Replacer Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the word_replacer_ultra() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to update arbitrary content on the affected WordPress site.

Affects Plugins

Plugin icon
word-replacer-ultra
No known fix

References

CVE
CVE-2024-1733
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1da53718-c2a2-45d0-ad43-daff3c68342d

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Lucio Sá
Verified
No
WPVDB ID
ae9dc725-0054-4e57-bd33-503f0a86619a

Timeline

Publicly Published
2024-03-15 (about 2 years ago)
Added
2024-03-15 (about 2 years ago)
Last Updated
2024-03-15 (about 2 years ago)

Other

Published
Title
Published
2025-07-03
Title
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function
Published
2025-07-22
Title
LoginWP - Pro < 4.0.8.6 - Missing Authorization to Unauthenticated Settings Update
Published
2025-08-26
Title
Parallax Section block < 2.0.0 - Missing Authorization
Published
2025-05-01
Title
Homey - Booking and Rentals WordPress Theme < 2.4.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion
Published
2024-07-11
Title
Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization