CVE-2024-13800

Summary

CVE-2024-13800 is a vulnerability affecting the ConvertPlus plugin for WordPress. This issue allows authenticated attackers, with Subscriber-level access and above, to manipulate data on vulnerable sites. The 'cp_dismiss_notice' AJAX endpoint in all versions up to 3.5.30 lacks necessary capability checks. By exploiting this flaw, attackers can update option values, potentially causing a denial of service. Additionally, they can enable certain features, such as registration, which can impact site functionality for legitimate users.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.