CVE-2024-0366

The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user controlled key. This makes it possible for subscribers to view plugin preferences and potentially other user settings.

• CWE-284
• CWE-639

• https://plugins.trac.wordpress.org/browser/starbox/trunk/core/UserSettings.phpIssue Tracking
• https://plugins.trac.wordpress.org/changeset/3028775/starbox/trunk?contextall=1&old=3000701&old_path=%2Fstarbox%2FtrunkIssue Tracking
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c47601b4-bf16-4f59-b5f3-584a8eac7c67?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/starbox/trunk/core/UserSettings.phpIssue Tracking
• https://plugins.trac.wordpress.org/changeset/3028775/starbox/trunk?contextall=1&old=3000701&old_path=%2Fstarbox%2FtrunkIssue Tracking
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c47601b4-bf16-4f59-b5f3-584a8eac7c67?source=cveThird Party Advisory

Published

Feb 5, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0360A vulnerability was found in PHPGurukul Hospital Management …9.8
• CVE-2024-0361A vulnerability classified as critical has been found in PHP…9.8
• CVE-2024-0362A vulnerability classified as critical was found in PHPGuruk…9.8
• CVE-2024-0363A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-0364A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-0365The Fancy Product Designer WordPress plugin before 6.1.5 doe…6.5
• CVE-2024-0367The Unlimited Elements For Elementor plugin for WordPress is…5.4
• CVE-2024-0368The Hustle – Email Marketing, Lead Generation, Optins, Popup…8.6
• CVE-2024-0369The Bulk Edit Post Titles plugin for WordPress is vulnerable…4.3
• CVE-2024-0370The Views for WPForms – Display & Edit WPForms Entries on yo…4.3
• CVE-2024-0371The Views for WPForms – Display & Edit WPForms Entries on yo…4.3
• CVE-2024-0372The Views for WPForms – Display & Edit WPForms Entries on yo…4.3