CVE-2024-6591CWE-862

Ultimate WordPress Auction Plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation

Medium · published July 27, 2024

CVSS v3.1
5.8
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-07-27T01:51Z
EPSS history
Timeline
  • 27 JUL 01:51Z
    Ultimate WordPress Auction Plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation
    cvelistv5