CVE-2024-12413
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Published Dec 25, 2024
CWE ID 862
Summary
CVE-2024-12413: The MarketKing plugin for WordPress, used in Ultimate WooCommerce Multivendor Marketplace Solutions, contains several unchecked capability functions. These unchecked functions, including 'marketking_delete_team_member' and 'marketkingrejectuser', allow unauthenticated attackers to delete users, update settings, approve users, and perform other unauthorized actions in all versions up to 2.0.00. This vulnerability poses a significant risk to WordPress sites using this plugin and requires immediate attention and patching.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.