CVE-2024-8552: falha de média gravidade em wpchill Download Monitor
Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.4%
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
wpchill · Download MonitorCVEs relacionadas — wpchill Download Monitor
No mesmo produto, das mais perigosas para as menos.
CVE-2022-4972HIGHDownload Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data ExportEPSS 0.5%CVE-2024-10092MEDIUMDownload Monitor <= 5.0.12 - Missing Authorization to API Key ManipulationEPSS 0.5%CVE-2024-10399MEDIUMDownload Monitor <= 5.0.13 - Missing Authorization to Sensitive Information ExposureEPSS 0.4%CVE-2026-100182HIGHDownload Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin EditorEPSS 0.3%CVE-2024-3269MEDIUMDownload Monitor <= 4.9.13 - Missing AuthorizationEPSS 0.3%CVE-2026-3124HIGHDownload Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'EPSS 0.3%