CVE-2024-0900

The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! plugin for WordPress is vulnerable to unauthorized post creation due to a missing capability check on the elespare_create_post() function hooked via AJAX in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary posts.

• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071565%40elespare&new=3071565%40elespare&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7f94efa6-b88b-442d-8162-f03efa7f2f65?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071565%40elespare&new=3071565%40elespare&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7f94efa6-b88b-442d-8162-f03efa7f2f65?source=cve

Published

Apr 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0893The Schema App Structured Data plugin for WordPress is vulne…4.3
• CVE-2024-0895The PDF Flipbook, 3D Flipbook – DearFlip plugin for WordPres…5.4
• CVE-2024-0896The Beaver Builder – WordPress Page Builder plugin for WordP…5.4
• CVE-2024-0897The Beaver Builder – WordPress Page Builder plugin for WordP…5.4
• CVE-2024-0898The Chat Bubble – Floating Chat with Contact Chat Icons, Mes…4.8
• CVE-2024-0899The s2Member – Best Membership Plugin for All Kinds of Membe…5.3
• CVE-2024-0901Remotely executed SEGV and out of bounds read allows malicio…9.1
• CVE-2024-0902The Fancy Product Designer WordPress plugin before 6.1.81 do…4.8
• CVE-2024-0903The User Feedback – Create Interactive Feedback Form, User S…6.1
• CVE-2024-0904The Fancy Product Designer WordPress plugin before 6.1.81 do…5.9
• CVE-2024-0905The Fancy Product Designer WordPress plugin before 6.1.8 doe…6.3
• CVE-2024-0906The f(x) Private Site plugin for WordPress is vulnerable to …5.3