CVE-2024-32818 WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Broken Access Control vulnerability

What is CVE-2024-32818?

CVE-2024-32818 is a medium-severity missing authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF), published on 9 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.

Weakness: CWE-862

Which versions are affected by CVE-2024-32818?

It affects 1 product.

Products include Pluginus Wordpress Meta Data and Taxonomies Filter.

How do I fix CVE-2024-32818?

No fix has been published for CVE-2024-32818 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-32818 being exploited?

There is no known exploitation of CVE-2024-32818 in the wild and no public exploit code.

Other vulnerabilities in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF)

• CVE-2024-8624 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Authenticated (Contributor+) SQL Injection Critical 9.9
• CVE-2021-20781 Cross-site request forgery in WordPress Meta Data Filter & Taxonomies Filter High 8.8
• CVE-2024-50450 WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerability High 7.3
• CVE-2024-8623 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution High 7.3
• CVE-2024-29763 WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cqv3-c339-xwx4.