Vulnerability · Published Dec 16, 2024 · Assigned by Patchstack
CVE-2024-54369WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability
Critical 9.1
In plain English
A critical-severity missing authorization in Zita Site Builder from ThemeHunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.6%top 23.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ThemeHunk | Zita Site Builder | 0 – through 1.0.2 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H