CVE-2024-10578

Summary

CVE-2024-10578 is a vulnerability affecting the Pubnews theme for WordPress. This issue permits authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins undetected due to a missing capability check on the `pubnews_importer_plugin_action_for_notice()` function. The vulnerability exists in all versions up to and including 1.0.7. Successful exploitation of this flaw can lead to further exploitation of other vulnerabilities in the installed plugins.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.