CVE-2024-4788

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-4788
The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_bhf_post function in all versions up to, and including, 1.3.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages or posts with arbitrary content.

4.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/1090acfc-5b0c-478a-ac71-db54fdaefdf5?source=cve Patch Third Party Advisory
https://plugins.trac.wordpress.org/browser/boostify-header-footer-builder/trunk/inc/admin/class-admin.php#L280 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:woostify:boostify_header_footer_builder_for_elementor:*:*:*:*:*:wordpress:*:*
History

05 Aug 2024, 20:23

Type Values Removed Values Added
CPE cpe:2.3:a:woostify:boostify_header_footer_builder_for_elementor:*:*:*:*:*:wordpress:*:*
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/1090acfc-5b0c-478a-ac71-db54fdaefdf5?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/1090acfc-5b0c-478a-ac71-db54fdaefdf5?source=cve - Patch, Third Party Advisory
References () https://plugins.trac.wordpress.org/browser/boostify-header-footer-builder/trunk/inc/admin/class-admin.php#L280 - () https://plugins.trac.wordpress.org/browser/boostify-header-footer-builder/trunk/inc/admin/class-admin.php#L280 - Patch
First Time Woostify
Woostify boostify Header Footer Builder For Elementor
CWE CWE-862

06 Jun 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-06 02:15

Updated : 2024-08-05 20:23

NVD link : CVE-2024-4788

Mitre link : CVE-2024-4788

JSON object : View

Products Affected

woostify

  • boostify_header_footer_builder_for_elementor
CWE
CWE-862

Missing Authorization