CVE-2024-6120 Missing authorization in Sparkle Demo Importer
Authenticated subscribers can delete site content and install demo plugins due to missing capability checks in the Sparkle Demo Importer plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6120?
CVE-2024-6120 is a medium-severity missing authorization vulnerability in sparklewpthemes Sparkle Demo Importer, published on 21 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability check on the multiple functions in all versions up to and including 1.4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all posts, pages, and uploaded files, as well as download and install a limited set of demo plugins.
Weakness: CWE-862
Which versions are affected by CVE-2024-6120?
It affects 1 product.
Products include Wpneuron Sparkle Demo Importer.
How do I fix CVE-2024-6120?
No fix has been published for CVE-2024-6120 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-6120 being exploited?
There is no known exploitation of CVE-2024-6120 in the wild and no public exploit code.
Sources
Also known as GHSA-gjp6-cpfp-vxjm.