CVE-2024-2505

GamiPress < 6.8.9 - Broken Access Control

High · published April 29, 2024

CVSS v3.1
8.1
EPSS
1%
Percentile
49.8
In the wild
Unconfirmed
What it is

The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requests and extend access to lower privileged users, like Subscribers, despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical GamiPress WordPress plugin before 6.8.9 configurations.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00635 · 49.8th percentile
Published
2024-04-29T06:00Z
EPSS history
Timeline
  • 29 APR 06:00Z
    GamiPress < 6.8.9 - Broken Access Control
    cvelistv5