CVE-2024-3895CWE-862

WP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

High · published May 2, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_new_datepicker_ajax() function in all versions up to, and including, 2.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options that can be used for privilege escalation. This was partially patched in 2.0.9 and 2.1.0, and fully patched in 2.1.1.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00911 · 59.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-05-02T16:52Z
EPSS history
Timeline
  • 02 MAY 16:52Z
    WP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
    cvelistv5