CVE-2024-6750 Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions

What is CVE-2024-6750?

CVE-2024-6750 is a high-severity missing authorization vulnerability in WPWeb Social Auto Poster, published on 24 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.

Weakness: CWE-862

Which versions are affected by CVE-2024-6750?

It affects 1 product.

Products include Wpwebinfotech Social Auto Poster.

How do I fix CVE-2024-6750?

No fix has been published for CVE-2024-6750 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-6750 being exploited?

There is no known exploitation of CVE-2024-6750 in the wild and no public exploit code.

Other vulnerabilities in WPWeb Social Auto Poster

• CVE-2024-6756 Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload High 8.8
• CVE-2024-6753 Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting High 7.2
• CVE-2024-47369 WordPress Social Auto Poster plugin <= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2024-6755 Social Auto Poster <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion Medium 6.5
• CVE-2024-6752 Social Auto Poster <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r768-6rj3-3r5q.