CVE-2024-1043mediumCWE-285

CVE-2024-1043: medium-severity vulnerability in mohammed_kaludi AMP for WP – Accelerated…

AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data

Published · Updated

Follow this CVE+ Monitor AMP for WP – Accelerated Mobile Pages

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.7%
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remove_saved_layout_data' function in all versions up to, and including, 1.0.93.1. This makes it possible for authenticated attackers, with contributor access and above, to delete arbitrary posts on the site.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
mohammed_kaludi · AMP for WP – Accelerated Mobile Pages
Related CVEs — mohammed_kaludi AMP for WP – Accelerated…

In the same product, most dangerous first.

CVE-2026-6101HIGHAMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font UploadEPSS 1.0%CVE-2023-6782MEDIUMAMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-0587MEDIUMAccelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-6896MEDIUMAMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2026-83591HIGHAMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex TransformationEPSS 0.3%CVE-2024-9598HIGHAMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege EscalationEPSS 0.3%