CVE-2024-10574

Summary

CVE-2024-10574 is a vulnerability affecting the Quiz Maker Business, Developer, and Agency plugins for WordPress. The issue lies in the 'ays_save_google_credentials' function, which lacks adequate capability checks. This flaw allows unauthenticated attackers to modify the Google Sheets integration credentials within the plugin's settings. Moreover, the 'client_id' parameter is not properly sanitized or escaped during output, enabling attackers to inject arbitrary web scripts that execute when users access injected pages. This vulnerability can lead to unauthorized data modification and potential code injection attacks. Users are advised to update their plugins to the latest versions as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.