CVE-2024-34824 WordPress SportsPress – Sports Club & League Manager plugin <= 2.7.20 - Broken Access Control vulnerability

What is CVE-2024-34824?

CVE-2024-34824 is a medium-severity missing authorization vulnerability in ThemeBoy SportsPress – Sports Club & League Manager, published on 11 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing Authorization vulnerability in ThemeBoy SportsPress – Sports Club & League Manager.This issue affects SportsPress – Sports Club & League Manager: from n/a through 2.7.20.

Weakness: CWE-862

Which versions are affected by CVE-2024-34824?

It affects 1 product.

Products include Themeboy Sportspress.

How do I fix CVE-2024-34824?

No fix has been published for CVE-2024-34824 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-34824 being exploited?

There is no known exploitation of CVE-2024-34824 in the wild and no public exploit code.

Other vulnerabilities in ThemeBoy SportsPress – Sports Club & League Manager

• CVE-2021-24578 SportsPress < 2.7.9 - Reflected Cross-Site Scripting Medium 6.1
• CVE-2020-13892 Cross-site scripting in n/a Medium 5.4
• CVE-2024-1178 SportsPress – Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update Medium 5.3
• CVE-2024-3986 SportsPress < 2.7.22 - Admin+ Stored XSS Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xw37-xfrp-pmwc.