CVE-2024-1043mediumCWE-285

CVE-2024-1043: fallo de gravedad media en mohammed_kaludi AMP for WP – Accelerated…

AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear AMP for WP – Accelerated Mobile Pages

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.7%
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remove_saved_layout_data' function in all versions up to, and including, 1.0.93.1. This makes it possible for authenticated attackers, with contributor access and above, to delete arbitrary posts on the site.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Productos afectados
mohammed_kaludi · AMP for WP – Accelerated Mobile Pages
CVEs relacionadas — mohammed_kaludi AMP for WP – Accelerated…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-6101HIGHAMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font UploadEPSS 1.0%CVE-2023-6782MEDIUMAMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-0587MEDIUMAccelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-6896MEDIUMAMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2026-83591HIGHAMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex TransformationEPSS 0.3%CVE-2024-9598HIGHAMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege EscalationEPSS 0.3%