CVE-2024-2543

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts.

• CWE-639
• CWE-862

• https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/3053899/Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cveThird Party Advisory
• https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/3053899/Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cveThird Party Advisory

Published

Apr 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2542The Jotform Online Forms – Drag & Drop Form Builder, Securel…6.4
• CVE-2024-25420An issue in Ignite Realtime Openfire before 4.8.1 allows a r…7.2
• CVE-2024-25421An issue in Ignite Realtime Openfire v.4.9.0 and before allo…9.8
• CVE-2024-25422SQL Injection vulnerability in SEMCMS v.4.8 allows a remote …9.8
• CVE-2024-25423An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacke…7
• CVE-2024-25428SQL Injection vulnerability in MRCMS v3.1.2 allows attackers…6.5
• CVE-2024-25431An issue in bytecodealliance wasm-micro-runtime before v.b3f…7.8
• CVE-2024-25434A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 a…5.4
• CVE-2024-25435A cross-site scripting (XSS) vulnerability in Md1health Md1p…6.1
• CVE-2024-25436A cross-site scripting (XSS) vulnerability in the Production…6.1
• CVE-2024-25438A cross-site scripting (XSS) vulnerability in the Submission…6.1
• CVE-2024-2544The Popup Builder plugin for WordPress is vulnerable to unau…6.4