CVE-2024-3607 PropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

What is CVE-2024-3607?

CVE-2024-3607 is a medium-severity missing authorization vulnerability in propertyhive Property Hive, published on 2 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() function in all versions up to, and including, 2.0.12. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts

Weakness: CWE-862

Which versions are affected by CVE-2024-3607?

It affects 1 product.

Products include Wp-Property-Hive Propertyhive.

How do I fix CVE-2024-3607?

No fix has been published for CVE-2024-3607 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-3607 being exploited?

There is no known exploitation of CVE-2024-3607 in the wild and no public exploit code.

Other vulnerabilities in propertyhive Property Hive

• CVE-2024-8490 PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_details High 8.8
• CVE-2024-23513 WordPress PropertyHive Plugin <= 2.0.5 is vulnerable to PHP Object Injection High 8.7
• CVE-2024-29923 WordPress PropertyHive plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2023-22706 WordPress PropertyHive Plugin <= 1.5.48 is vulnerable to Cross Site Scripting (XSS) High 7.1
• CVE-2023-29172 WordPress PropertyHive Plugin <= 1.5.46 is vulnerable to Cross Site Scripting (XSS) High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xcf2-9gfx-5x8f.