CVE-2024-4566

The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers, with contributor-level access and above, to set arbitrary WordPress options to "true". NOTE: This vulnerability can be exploited by attackers with subscriber- or customer-level access and above if (1) the WooCommerce plugin is deactivated or (2) access to the default WordPress admin dashboard is explicitly enabled for authenticated users.

• CWE-862
• CWE-862

• https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/admin/include/class.notice.php#L52Product
• https://plugins.trac.wordpress.org/changeset/3088881/woolentor-addons/trunk/includes/admin/include/class.notice.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c6aaabe9-4f55-4c01-b350-573e6a944353?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/admin/include/class.notice.php#L52Product
• https://plugins.trac.wordpress.org/changeset/3088881/woolentor-addons/trunk/includes/admin/include/class.notice.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c6aaabe9-4f55-4c01-b350-573e6a944353?source=cveThird Party Advisory

Published

May 21, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45654IBM Security ReaQta 3.12 could allow an authenticated user t…4.3
• CVE-2024-45655IBM Application Gateway 19.12 through 24.09 could allow a lo…5.5
• CVE-2024-45656IBM Flexible Service Processor (FSP) FW860.00 through FW860.…9.8
• CVE-2024-45657IBM Security Verify Access Appliance and Container 10.0.0 th…6.7
• CVE-2024-45658IBM Security Verify Access Appliance and Container 10.0.0 th…5.3
• CVE-2024-45659IBM Security Verify Access Appliance and Container 10.0.0 th…5.3
• CVE-2024-45662IBM Safer Payments 6.4.0.00 through 6.4.2.07, 6.5.0.00 throu…7.5
• CVE-2024-45663IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Se…7.5
• CVE-2024-45669IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7…6.5
• CVE-2024-4567The Themify Shortcodes plugin for WordPress is vulnerable to…5.4
• CVE-2024-45670IBM Security SOAR 51.0.1.0 and earlier contains a mechanism …8.1
• CVE-2024-45671IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7…7.5