Vulnerability · Published Jul 27, 2024 · Assigned by Wordfence
CVE-2024-4410IgnitionDeck Crowdfunding Platform <= 1.9.8 - Missing Authorization
Medium 5.4
In plain English
A medium-severity missing authorization in IgnitionDeck Crowdfunding Platform from ignitionwp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the ~/classes/class-idf-wizard.php file. This makes it possible for authenticated attackers, with subscriber access or higher, to execute various AJAX actions. This includes actions to change the permalink structure, plugin settings and others.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ignitionwp | IgnitionDeck Crowdfunding Platform | 0 – through 1.9.8 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/07b6aad4-fbaf-4c0c-b2b7-6e264a1afb9b?source=cve
- https://plugins.trac.wordpress.org/browser/ignitiondeck/trunk/classes/class-idf-wizard.php#L186
- https://plugins.trac.wordpress.org/browser/ignitiondeck/trunk/classes/class-idf-wizard.php#L1162
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3134431%40ignitiondeck%2Ftrunk&old=3097520%40ignitiondeck%2Ftrunk&sfp_email=&sfph_mail=