WordPress Plugin Vulnerabilities

Atarim < 3.30 - Unauthenticated Settings Update, Post Deletion etc

Description

The plugin is vulnerable to unauthorized access due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to modify plugin settings, delete posts, modify post titles, and upload images.

Affects Plugins

Plugin icon
atarim-visual-collaboration
Fixed in 3.30

References

CVE
CVE-2024-2038
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/29532f4d-e830-4c99-ad77-076eebbbe98d

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Lucio Sá
Verified
No
WPVDB ID
e4120145-fb75-48ff-a9e0-44db5676a61d

Timeline

Publicly Published
2024-05-22 (about 2 years ago)
Added
2024-05-23 (about 2 years ago)
Last Updated
2024-05-23 (about 2 years ago)

Other

Published
Title
Published
2025-04-07
Title
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update
Published
2025-08-11
Title
UiCore Elements < 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Read
Published
2026-01-06
Title
Quote Comments <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
Published
2024-01-02
Title
Product Expiry for WooCommerce < 2.6 - Subscriber+ Settings Update
Published
2025-01-07
Title
1003 Mortgage Application <= 1.87 - Missing Authorization