CVE-2024-11194highCWE-862

CVE-2024-11194: falha de alta gravidade em techlabpro1 Classified Listing – AI-Powered…

Classified Listing – Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Classified Listing – AI-Powered Classified ads & Business Directory Plugin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.6%
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtcl_import_settings' function in all versions up to, and including, 3.1.15.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited arbitrary options on the WordPress site. This can be leveraged to update the Subscriber role with Administrator-level capabilities to gain administrative user access to a vulnerable site. The vulnerability is limited in that the option updated must have a value that is an array.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
techlabpro1 · Classified Listing – AI-Powered Classified ads & Business Directory Plugin
CVEs relacionadas — techlabpro1 Classified Listing – AI-Powered…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1352MEDIUMClassified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing AuthorizationEPSS 0.5%CVE-2024-1315HIGHClassified Listing <= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_accountEPSS 0.5%CVE-2024-3893MEDIUMClassified Listing – Classified ads & Business Directory Plugin <= 3.0.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment DeletionEPSS 0.4%CVE-2025-1063MEDIUMClassified Listing – Classified ads & Business Directory Plugin <= 4.0.4 - Unauthenticated Settings ExposureEPSS 0.4%CVE-2024-7888MEDIUMClassified Listing – Classified ads & Business Directory Plugin <= 3.1.7 - Missing AuthorizationEPSS 0.3%CVE-2026-7563MEDIUMClassified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX ActionsEPSS 0.3%