CVE-2024-32799 WordPress Easy Property Listings plugin <= 3.5.3 - Broken Access Control vulnerability
Attackers can bypass authorization checks in the Easy Property Listings WordPress plugin to access restricted functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-32799?
CVE-2024-32799 is a medium-severity missing authorization vulnerability in Merv Barrett Easy Property Listings, published on 9 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization vulnerability in Merv Barrett Easy Property Listings.This issue affects Easy Property Listings: from n/a through 3.5.3.
Weakness: CWE-862
Which versions are affected by CVE-2024-32799?
It affects 1 product.
Products include Realestateconnected Easy Property Listings.
How do I fix CVE-2024-32799?
No fix has been published for CVE-2024-32799 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-32799 being exploited?
There is no known exploitation of CVE-2024-32799 in the wild and no public exploit code.
Other vulnerabilities in Merv Barrett Easy Property Listings
- CVE-2024-1893 Easy Property Listings <= 3.5.2 - Authenticated(Contributor+) SQL Injection via Shortcode
- CVE-2020-5530 Cross-site request forgery in Easy Property Listings
- CVE-2019-15817 Cross-site scripting in n/a
- CVE-2024-2869 Easy Property Listings <= 3.5.3 - Admin+ Stored XSS
- CVE-2024-3163 Easy Property Listings < 3.5.4 - Arbitrary Contact Deletion via CSRF
Sources
Also known as GHSA-8w59-2cjf-v663.