CVE-2024-1110: fallo de gravedad media en eteubert Podlove Podcast Publisher
Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import
Publicada el · Actualizada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.5%
probabilidad de explotación
0.5%top 57% de las CVE
explotación observada
noninguna fuente lo reporta
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
eteubert · Podlove Podcast PublisherCVEs relacionadas — eteubert Podlove Podcast Publisher
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-13001CRITICALPodlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url ParameterEPSS 3.8%CVE-2026-16099HIGHPodlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' ParameterEPSS 1.1%CVE-2025-10147CRITICALPodlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2024-1109MEDIUMPodlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data ExportEPSS 0.5%CVE-2026-75966MEDIUMPodlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' ParameterEPSS 0.4%CVE-2025-0554MEDIUMPodlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed NameEPSS 0.3%
Referencias
https://github.com/podlove/podlove-publisher/commit/7873ff520631087e2f10737860cdcd64d53187bahttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032008%40podlove-podcasting-plugin-for-wordpress&new=3032008%40podlove-podcasting-plugin-for-wordpress&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9cf461-572c-4be8-96e6-659acf3208f3?source=cve