CVE-2024-13776

Summary

CVE-2024-13776: The WordPress plugin ZoomSounds - WordPress Wave Audio Player with Playlist is found to have a vulnerability. Authenticated attackers with Subscriber access or higher can exploit the missing capability check on the 'dzsap_delete_notice' AJAX action in versions up to 6.91. This issue allows attackers to update option values to 'seen', leading to potential denial of service for users. Some options, when set to true, could also result in site errors or unintended functionality. Other functions within the plugin are similarly vulnerable to insufficient authorization checks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.