WordPress Plugin Vulnerabilities

Zotpress < 7.3.13 - Missing Authorization

Description

The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin's settings.

Affects Plugins

Plugin icon
zotpress
Fixed in 7.3.13

References

CVE
CVE-2024-7429
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1f38676b-270f-4b0f-bc98-a14a26b86a50

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Rafshanzani Suhada
Verified
No
WPVDB ID
eda3b33e-2c90-4877-b4f8-892b3feb3e54

Timeline

Publicly Published
2024-11-04 (about 1 year ago)
Added
2024-11-04 (about 1 year ago)
Last Updated
2024-11-05 (about 1 year ago)

Other

Published
Title
Published
2021-11-03
Title
Event Manager for WooCommerce < 3.5.3 - Unauthenticated Arbitrary Options Reset
Published
2026-09-17
Title
WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting
Published
2022-06-09
Title
Social Share Buttons by Supsystic < 2.2.4 - Subscriber+ Unauthorised Actions
Published
2021-08-23
Title
Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update
Published
2026-09-10
Title
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass