SecuriTricks - CVE-2024-4858

Description

The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_testimonials_option_callback' function in versions up to, and including, 10.2.0. This makes it possible for unauthenticated attackers to update the OpenAI API key, disabling the feature.

Product(s) Impacted

Product	Versions
Testimonial Carousel For Elementor plugin for WordPress	['up to 10.2.0']

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/class-testimonials-carousel-elementor.php#L126

https://plugins.trac.wordpress.org/changeset/3092154/testimonials-carousel-elementor/trunk/class-testimonials-carousel-elementor.php

https://www.wordfence.com/threat-intel/vulnerabilities/id/1f589345-a081-4d27-ac4a-6edc44b96f91?source=cve

CVSS Score

5.3 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

View Vector String

Timeline

Published: May 25, 2024, 3:15 a.m.
Last Modified: May 25, 2024, 3:15 a.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@wordfence.com

CVE-2024-4858