CVE-2024-0710 GP Unique ID <= 1.5.5 - Unauthenticated Form Submission Unique ID Modification
Unauthenticated attackers can tamper with unique ID generation in form submissions, compromising data integrity in security-sensitive contexts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0710?
CVE-2024-0710 is a medium-severity vulnerability in Gravity Wiz GP Unique ID, published on 2 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The GP Unique ID plugin for WordPress is vulnerable to Unique ID Modification in all versions up to, and including, 1.5.5. This is due to insufficient input validation. This makes it possible for unauthenticated attackers to tamper with the generation of a unique ID on a form submission and replace the generated unique ID with a user-controlled one, leading to a loss of integrity in cases where the ID's uniqueness is relied upon in a security-specific context.
Weakness: CWE-20
Which versions are affected by CVE-2024-0710?
How do I fix CVE-2024-0710?
No fix has been published for CVE-2024-0710 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-0710 being exploited?
There is no known exploitation of CVE-2024-0710 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-96mg-ghxm-p7jr.