CVE-2024-0867 Email Log <= 2.4.8 - Unauthenticated Hook Injection
Unauthenticated attackers can inject hooks to execute arbitrary actions in the Email Log WordPress plugin if nonces are known and capability checks are missing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0867?
CVE-2024-0867 is a high-severity code injection vulnerability in webfactory Email Log, published on 24 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
Weakness: CWE-94
Which versions are affected by CVE-2024-0867?
How do I fix CVE-2024-0867?
No fix has been published for CVE-2024-0867 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-0867 being exploited?
There is no known exploitation of CVE-2024-0867 in the wild and no public exploit code.