CVE-2024-3249
Last modified
CVE-2024-3249 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_xml_data, xml_data_import, import_option_data, import_widgets, and import_customizer_settings functions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages, update certain options, including WooCommerce page titles and Elementor settings, import widgets, and update the plugin's customizer settings and the WordPress custom CSS. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_xml_data, xml_data_import, import_option_data, import_widgets, and import_customizer_settings functions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages, update certain options, including WooCommerce page titles and Elementor settings, import widgets, and update the plugin's customizer settings and the WordPress custom CSS. NOTE: This vulnerability was partially fixed in version 1.6.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-3249?
How severe is CVE-2024-3249?
How do I fix CVE-2024-3249?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-32483Improper access control for some Intel(R) EMA software befor…8.2
- CVE-2024-32484An reflected XSS vulnerability exists in the handling of inv…8.2
- CVE-2024-32485Improper Input Validation in some Intel(R) VROC software bef…5.5
- CVE-2024-32487less through 653 allows OS command execution via a newline c…8.6
- CVE-2024-32488In Foxit PDF Reader and Editor before 2024.1, Local Privileg…7.8
- CVE-2024-32489TCPDF before 6.7.4 mishandles calls that use HTML syntax.6.1
- CVE-2024-32491An issue was discovered in Znuny and Znuny LTS 6.0.31 throug…9.8
- CVE-2024-32492An issue was discovered in Znuny 7.0.1 through 7.0.16 where …7.1
- CVE-2024-32493An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and…8.8
- CVE-2024-32498An issue was discovered in OpenStack Cinder through 24.0.0, …6.5
- CVE-2024-32499Newforma Project Center Server through 2023.3.0.32259 allows…9.8
- CVE-2024-3250It was discovered that Canonical's Pebble service manager re…6.5
Are you affected by CVE-2024-3249?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST