Vulnerability · Published Jul 9, 2024 · Assigned by Wordfence
CVE-2024-5855Media Hygiene <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion
Medium 4.3
In plain English
A medium-severity missing authorization in Media Hygiene: Remove or Delete Unused Images and More! from slui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
The Media Hygiene: Remove or Delete Unused Images and More! plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the bulk_action_delete and delete_single_image_call AJAX actions in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments. A nonce check was added in version 3.0.1, however, it wasn't until version 3.0.2 that a capability check was added.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| slui | Media Hygiene: Remove or Delete Unused Images and More! | 0 – through 3.0.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L