CVE-2024-4410

The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the ~/classes/class-idf-wizard.php file. This makes it possible for authenticated attackers, with subscriber access or higher, to execute various AJAX actions. This includes actions to change the permalink structure, plugin settings and others.

• CWE-862

• https://plugins.trac.wordpress.org/browser/ignitiondeck/trunk/classes/class-idf-wizard.php#L1162
• https://plugins.trac.wordpress.org/browser/ignitiondeck/trunk/classes/class-idf-wizard.php#L186
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3134431%40ignitiondeck%2Ftrunk&old=3097520%40ignitiondeck%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/07b6aad4-fbaf-4c0c-b2b7-6e264a1afb9b?source=cve
• https://plugins.trac.wordpress.org/browser/ignitiondeck/trunk/classes/class-idf-wizard.php#L1162
• https://plugins.trac.wordpress.org/browser/ignitiondeck/trunk/classes/class-idf-wizard.php#L186
• https://www.wordfence.com/threat-intel/vulnerabilities/id/07b6aad4-fbaf-4c0c-b2b7-6e264a1afb9b?source=cve

Published

Jul 27, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-44094In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possi…7.8
• CVE-2024-44095In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possi…7.8
• CVE-2024-44096there is a possible arbitrary read due to an insecure defaul…4.4
• CVE-2024-44097According to the researcher: "The TLS connections are encryp…9.8
• CVE-2024-44098In lwis_device_event_states_clear_locked of lwis_event.c, th…7.4
• CVE-2024-44099There is a possible Local bypass of user interaction due to …5.5
• CVE-2024-44100Android before 2024-10-05 on Google Pixel devices allows inf…7.5
• CVE-2024-44101there is a possible Null Pointer Dereference (modem crash) d…7.5
• CVE-2024-44102A vulnerability has been identified in PP TeleControl Server…10
• CVE-2024-44103DLL hijacking in the management console of Ivanti Workspace …7.8
• CVE-2024-44104An incorrectly implemented authentication scheme that is sub…7.8
• CVE-2024-44105Cleartext transmission of sensitive information in the manag…7.8