PT-2024-37202 · WordPress · Easy Image Collage

Lucio Sá

·

CVE-2024-5863

·

Published

2024-06-28

·

Updated

2024-06-28

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Name of the Vulnerable Software and Affected Versions: Easy Image Collage plugin for WordPress versions prior to 1.13.6
Description: The issue allows authenticated attackers with Contributor-level access and above to erase all content in arbitrary posts due to a missing capability check on the ajax image collage() function.
Recommendations: For versions prior to 1.13.6, update to version 1.13.6 or later to resolve the issue.

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-5863

Affected Products

Easy Image Collage