CVE-2024-47302 WordPress Fluent Support plugin <= 1.8.0 - Broken Access Control on Email Verification vulnerability
Attackers can bypass email verification controls in the Fluent Support WordPress plugin due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-47302?
CVE-2024-47302 is a medium-severity missing authorization vulnerability in Shahjahan Jewel Fluent Support, published on 1 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Support: from n/a through <= 1.8.0.
Weakness: CWE-862
Which versions are affected by CVE-2024-47302?
It affects 1 product.
Products include Wpmanageninja Fluent Support.
How do I fix CVE-2024-47302?
No fix has been published for CVE-2024-47302 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-47302 being exploited?
There is no known exploitation of CVE-2024-47302 in the wild and no public exploit code.
Other vulnerabilities in Shahjahan Jewel Fluent Support
- CVE-2024-47304 WordPress Fluent Support plugin <= 1.8.0 - SQL Injection vulnerability
- CVE-2023-51547 WordPress Fluent Support Plugin <= 1.7.6 is vulnerable to SQL Injection
- CVE-2024-13568 Information disclosure in Fluent Support – Helpdesk & Customer Support Ticket System
- CVE-2022-2559 Fluent Support < 1.5.8 - Admin+ SQLi
Sources
Also known as GHSA-4w9r-55f5-5mhh.