CVE-2024-7381CWE-862

Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution

Medium · published September 5, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-09-05T11:00Z
EPSS history
Timeline
  • 05 SEP 11:00Z
    Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution
    cvelistv5