WordPress Plugin Vulnerabilities

Sign-up Sheets < 2.2.13 - Missing Authorization

Description

The Sign-up Sheets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cleanArray() function in versions up to, and including, 2.2.12. This makes it possible for unauthenticated attackers to clean data.

Affects Plugins

Plugin icon
sign-up-sheets
Fixed in 2.2.13

References

CVE
CVE-2024-39654
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2389f614-a9e6-479c-a713-71271d3a35c6

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Joshua Chan
Verified
No
WPVDB ID
f51d64d2-25d8-40b2-8d3e-87e703290cc2

Timeline

Publicly Published
2024-08-01 (about 2 years ago)
Added
2024-08-08 (about 2 years ago)
Last Updated
2024-08-08 (about 2 years ago)

Other

Published
Title
Published
2024-05-07
Title
Shared Files < 1.7.20 - Missing Authorization
Published
2026-01-29
Title
WP Job Manager < 2.4.1 - Missing Authorization
Published
2026-07-27
Title
Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX
Published
2026-05-12
Title
Cost Calculator Builder < 4.0.2 - Unauthenticated Price Manipulation and Insecure Direct Object Reference
Published
2024-04-29
Title
Digital Publications by Supsystic < 1.7.8 - Missing Authorization