CVE-2024-9860

Summary

CVE-2024-9860 identifies a vulnerability in the Bridge Core plugin for WordPress, affecting versions up to and including 3.3, that allows authenticated attackers with subscriber-level permissions or higher to modify or delete data without proper authorization. This flaw results from a missing capability check on the 'import_action' and 'install_plugin_per_demo' functions, which can lead to unauthorized changes in plugin settings, importing demo data, and limited plugin installations. Organizations using this plugin face potential risks such as data loss and unauthorized modifications that could compromise the integrity of their WordPress sites. To remediate this vulnerability, users are advised to update the Bridge Core plugin to the latest version where this issue has been addressed. The vulnerability has a medium severity rating with a CVSS score of 6.5 and an exploitability score of 3.9, indicating that it poses a significant risk if left unmitigated.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.