CVE-2024-34444 WordPress Slider Revolution plugin < 6.7.0 - Unauthenticated Broken Access Control vulnerability
Unauthenticated attackers can bypass access controls in the Slider Revolution WordPress plugin, potentially accessing restricted functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-34444?
CVE-2024-34444 is a high-severity missing authorization vulnerability in ThemePunch OHG Slider Revolution, published on 19 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Missing Authorization vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a before 6.7.0.
Weakness: CWE-862
Which versions are affected by CVE-2024-34444?
It affects 1 product.
Products include Themepunch Slider Revolution.
How do I fix CVE-2024-34444?
No fix has been published for CVE-2024-34444 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-34444 being exploited?
There is no known exploitation of CVE-2024-34444 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in ThemePunch OHG Slider Revolution
- CVE-2023-6528 Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE
- CVE-2023-2359 Revolution Slider <= 6.6.12 - Author+ Remote Code Execution
- CVE-2023-47784 WordPress Slider Revolution Plugin <= 6.6.15 is vulnerable to Arbitrary File Upload
- CVE-2023-47772 WordPress Slider Revolution Plugin <= 6.6.14 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-8107 Slider Revolution <= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Sources
Also known as GHSA-7v92-r835-4388.