CVE-2024-6755 Social Auto Poster <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

What is CVE-2024-6755?

CVE-2024-6755 is a medium-severity missing authorization vulnerability in WPWeb Social Auto Poster, published on 24 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the ‘wpw_auto_poster_quick_delete_multiple’ function in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to delete arbitrary posts.

Weakness: CWE-862

Which versions are affected by CVE-2024-6755?

It affects 1 product.

Products include Wpwebinfotech Social Auto Poster.

How do I fix CVE-2024-6755?

No fix has been published for CVE-2024-6755 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-6755 being exploited?

There is no known exploitation of CVE-2024-6755 in the wild and no public exploit code.

Other vulnerabilities in WPWeb Social Auto Poster

• CVE-2024-6756 Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload High 8.8
• CVE-2024-6750 Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions High 7.3
• CVE-2024-6753 Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting High 7.2
• CVE-2024-47369 WordPress Social Auto Poster plugin <= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2024-6752 Social Auto Poster <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f7wp-vx7r-p4vf.