CVE-2024-9705

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-9705
The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ucsm_update_template_name_lite' function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the name of the plugin's templates.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/ultimate-coming-soon/trunk/backend/tabs-content/templates/frontend-part/display-template.php#L139 Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/3bef108a-2c68-4347-bf53-559b2d877f6b?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:rstheme:ultimate_coming_soon_\&_maintenance:*:*:*:*:*:*:*:*
History

05 Jun 2025, 15:57

Type Values Removed Values Added
CPE cpe:2.3:a:rstheme:ultimate_coming_soon_\&_maintenance:*:*:*:*:*:*:*:*
Summary
  • (es) El complemento Ultimate Coming Soon & Maintenance para WordPress es vulnerable a la modificación no autorizada de datos debido a una verificación de capacidad faltante en la función 'ucsm_update_template_name_lite' en todas las versiones hasta la 1.0.9 incluida. Esto permite que atacantes autenticados, con acceso de nivel de suscriptor y superior, cambien el nombre de las plantillas del complemento.
References () https://plugins.trac.wordpress.org/browser/ultimate-coming-soon/trunk/backend/tabs-content/templates/frontend-part/display-template.php#L139 - () https://plugins.trac.wordpress.org/browser/ultimate-coming-soon/trunk/backend/tabs-content/templates/frontend-part/display-template.php#L139 - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/3bef108a-2c68-4347-bf53-559b2d877f6b?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/3bef108a-2c68-4347-bf53-559b2d877f6b?source=cve - Third Party Advisory
First Time Rstheme
Rstheme ultimate Coming Soon \& Maintenance

06 Dec 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-06 09:15

Updated : 2025-06-05 15:57

NVD link : CVE-2024-9705

Mitre link : CVE-2024-9705

CVE.ORG link : CVE-2024-9705

JSON object : View

Products Affected

rstheme

  • ultimate_coming_soon_\&_maintenance
CWE
CWE-862

Missing Authorization