WordPress Plugin Vulnerabilities

If Menu < 0.19.2 - Missing Authorization to License Key Update

Description

The If Menu plugin for WordPress is vulnerable to unauthorized modification of the plugin's license key due to a missing capability check on the 'actions' function in versions up to, and including, 0.19.1. This makes it possible for unauthenticated attackers to modify delete or modify the license key.

Affects Plugins

Plugin icon
if-menu
Fixed in 0.19.2

References

CVE
CVE-2024-7894
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6ebf45-4617-44dd-94d8-28aa8bc1609b

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Marco Wotschka
Verified
No
WPVDB ID
c37012d3-d83d-482d-9b78-088d5e6124cd

Timeline

Publicly Published
2024-12-06 (about 1 year ago)
Added
2024-12-06 (about 1 year ago)
Last Updated
2024-12-07 (about 1 year ago)

Other

Published
Title
Published
2024-04-17
Title
WPC Frequently Bought Together for WooCommerce < 7.0.4 - Missing Authorization
Published
2023-11-01
Title
Funnelforms Free < 3.4.2 - Missing Authorization to Test Email Sending
Published
2024-08-07
Title
Falang multilanguage for WordPress < 1.3.53 - Missing Authorization to Translation Update and Information Exposure
Published
2024-12-19
Title
Royal Elementor Addons < 1.7.1002 - Missing Authorization
Published
2026-02-06
Title
myCred < 2.9.7.4 - Missing Authorization