CVE-2024-30235 WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.0 - Broken Access Control vulnerability

What is CVE-2024-30235?

CVE-2024-30235 is a medium-severity missing authorization vulnerability in Themeisle Multiple Page Generator Plugin – MPG, published on 26 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing Authorization vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.

Weakness: CWE-862

Which versions are affected by CVE-2024-30235?

It affects 1 product.

Products include Themeisle Multiple Page Generator.

How do I fix CVE-2024-30235?

No fix has been published for CVE-2024-30235 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-30235 being exploited?

There is no known exploitation of CVE-2024-30235 in the wild and no public exploit code.

Other vulnerabilities in Themeisle Multiple Page Generator Plugin – MPG

• CVE-2024-27951 WordPress Multiple Page Generator Plugin <= 3.4.0 - Auth. Remote Code Execution (RCE) vulnerability Critical 9.1
• CVE-2024-47325 WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerability High 8.5
• CVE-2023-33927 WordPress Multiple Page Generator Plugin – MPG Plugin <= 3.3.19 is vulnerable to SQL Injection High 7.6
• CVE-2023-2607 Multiple Page Generator Plugin <= 3.3.17 - Authenticated (Administrator+) SQL Injection High 7.2
• CVE-2024-10705 Multiple Page Generator Plugin – MPG <= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-98fg-qw7m-42fj.