CVE-2024-10520

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-10520
The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the 'Create_Milestone', 'Create_Task_List', 'Create_Task', and 'Delete_Task' classes in version 2.6.14. This makes it possible for unauthenticated attackers to create milestones, create task lists, create tasks, or delete tasks in any project. NOTE: Version 2.6.14 implemented a partial fix for this vulnerability.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset/3191204/wedevs-project-manager Broken Link
https://www.wordfence.com/threat-intel/vulnerabilities/id/497760a8-7d4a-45a0-91e4-a8ee27bcdb02?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wedevs:wp_project_manager:*:*:*:*:*:wordpress:*:*
History

05 Feb 2025, 16:51

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/changeset/3191204/wedevs-project-manager - () https://plugins.trac.wordpress.org/changeset/3191204/wedevs-project-manager - Broken Link
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/497760a8-7d4a-45a0-91e4-a8ee27bcdb02?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/497760a8-7d4a-45a0-91e4-a8ee27bcdb02?source=cve - Third Party Advisory
First Time Wedevs
Wedevs wp Project Manager
CPE cpe:2.3:a:wedevs:wp_project_manager:*:*:*:*:*:wordpress:*:*

21 Nov 2024, 13:57

Type Values Removed Values Added
Summary
  • (es) El complemento WP Project Manager para WordPress es vulnerable a la modificación no autorizada de datos debido a una verificación de capacidad faltante en el método 'check' de las clases 'Create_Milestone', 'Create_Task_List', 'Create_Task' y 'Delete_Task' en la versión 2.6.14. Esto hace posible que atacantes no autenticados creen hitos, listas de tareas, tareas o eliminen tareas en cualquier proyecto. NOTA: La versión 2.6.14 implementó una corrección parcial para esta vulnerabilidad.

20 Nov 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-20 12:15

Updated : 2025-02-05 16:51

NVD link : CVE-2024-10520

Mitre link : CVE-2024-10520

CVE.ORG link : CVE-2024-10520

JSON object : View

Products Affected

wedevs

  • wp_project_manager
CWE
CWE-862

Missing Authorization