SecuriTricks - CVE-2024-13316

Description

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the apmswn_create_discount() function in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create coupons.

Product(s) Impacted

Vendor	Product	Versions
Akashmalik	Scracth \& Win	*

Weaknesses

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

*CPE(s)

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	akashmalik	scracth_\&_win	/	/	/	/	/	wordpress	/	/

References

https://plugins.trac.wordpress.org/browser/scratch-win-giveaways-for-website-facebook/tags/2.7.0/socialscratchwin.php#L492

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212730%40scratch-win-giveaways-for-website-facebook&new=3212730%40scratch-win-giveaways-for-website-facebook&sfp_email=&sfph_mail=

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3239997%40scratch-win-giveaways-for-website-facebook&new=3239997%40scratch-win-giveaways-for-website-facebook&sfp_email=&sfph_mail=

https://www.wordfence.com/threat-intel/vulnerabilities/id/95103830-9009-48df-ab15-476402b59e3f?source=cve

CVSS Score

5.3 / 10

CVSS Data

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: LOW
Availability Impact: NONE

View Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Date

Published: Feb. 18, 2025, 9:15 a.m.
Last Modified: Feb. 21, 2025, 3:28 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@wordfence.com

CVE-2024-13316