CVE-2024-6120

Name of the Vulnerable Software and Affected Versions: Sparkle Demo Importer plugin for WordPress versions up to and including 1.4.7

Description: The issue arises from a missing capability check on multiple functions, allowing authenticated attackers with Subscriber-level access and above to perform unauthorized actions. This includes deleting all posts, pages, and uploaded files, as well as downloading and installing a limited set of demo plugins.

Recommendations: For versions up to and including 1.4.7, update to a version that includes a fix for the missing capability check issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.