CVE-2024-9025

CVSS 3.1 Score 5.3 of 10 (medium)

Details

Published Sep 26, 2024
Updated: Oct 1, 2024
CWE ID 862

Summary

CVE-2024-9025 is a vulnerability affecting the Sight – Professional Image Gallery and Portfolio plugin for WordPress. This issue arises from a missing capability check on the 'handler_post_title' function present in all versions up to 1.1.2. Unauthenticated attackers can exploit this vulnerability and gain unauthorized access to private, pending, trashed, and draft post titles. It is important to note that for this attack to succeed, the Elementor plugin must also be installed and activated on the targeted WordPress site.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share