Vulnerability · Published Apr 29, 2024 · Assigned by Patchstack
CVE-2024-33686Broken Access Control vulnerability affecting multiple WordPress themes by Extend Themes
Medium 4.3
In plain English
A medium-severity missing authorization in Althea WP from Extend Themes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea WP: from n/a through 1.0.13; Elevate WP: from n/a through 1.0.15; Brite: from n/a through 1.0.11; Colibri WP: from n/a through 1.0.94; Vertice: from n/a through 1.0.7.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Extend Themes | Pathway | n/a – through 1.0.15 |
| Extend Themes | Hugo WP | n/a – through 1.0.8 |
| Extend Themes | Althea WP | n/a – through 1.0.13 |
| Extend Themes | Elevate WP | n/a – through 1.0.15 |
| Extend Themes | Brite | n/a – through 1.0.11 |
| Extend Themes | Colibri WP | n/a – through 1.0.94 |
| Extend Themes | Vertice | n/a – through 1.0.7 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- https://patchstack.com/database/vulnerability/pathway/wordpress-pathway-theme-1-0-15-cross-site-request-forgery-csrf-vulnerability vdb-entry
- https://patchstack.com/database/vulnerability/hugo-wp/wordpress-hugo-wp-theme-1-0-8-broken-access-control-vulnerability vdb-entry
- https://patchstack.com/database/vulnerability/althea-wp/wordpress-althea-wp-theme-1-0-13-broken-access-control-vulnerability vdb-entry
- https://patchstack.com/database/vulnerability/elevate-wp/wordpress-elevate-wp-theme-1-0-15-broken-access-control-vulnerability vdb-entry
- https://patchstack.com/database/vulnerability/brite/wordpress-brite-theme-1-0-11-broken-access-control-vulnerability vdb-entry
- https://patchstack.com/database/vulnerability/colibri-wp/wordpress-colibri-wp-theme-1-0-94-broken-access-control-vulnerability vdb-entry
- https://patchstack.com/database/vulnerability/vertice/wordpress-vertice-theme-1-0-7-broken-access-control-vulnerability vdb-entry