WordPress Th Shop Mania <= 1.4.9 CVE-2024-10674 Arbitrary Plugin Installation

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Name: Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation 2. Vulnerability Description: The Th Shop Mania theme contains a vulnerability allowing unauthorized arbitrary plugin installation/activation. This is due to the lack of permission checks in the function, including version 1.4.9. This enables authenticated attackers with Subscriber or higher privileges to install any plugin, potentially exploiting other vulnerabilities to achieve remote code execution and privilege escalation. 3. Vulnerability Rating: CVSS 3.1 score 8.8 (High), CVSS 2.0 score 6.8 (Medium). 4. Public Release Date: November 8, 2024. 5. Update Date: November 9, 2024. 6. Fix Status: Fixed. 7. Affected Versions: <= 1.4.9 8. Fixed Version: 1.5.0 9. Vulnerability ID: CVE-2024-10674 10. Vulnerability Type: Theme 11. Vulnerability Impact: Plugin Installation/Activation 12. Vulnerability Scope: WordPress Plugins/Themes 13. Vulnerability Privilege Level: Subscriber and above 14. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 15. Vulnerability Scope: WordPress Plugins/Themes 16. Vulnerability Privilege Level: Subscriber and above 17. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 18. Vulnerability Scope: WordPress Plugins/Themes 19. Vulnerability Privilege Level: Subscriber and above 20. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 21. Vulnerability Scope: WordPress Plugins/Themes 22. Vulnerability Privilege Level: Subscriber and above 23. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 24. Vulnerability Scope: WordPress Plugins/Themes 25. Vulnerability Privilege Level: Subscriber and above 26. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 27. Vulnerability Scope: WordPress Plugins/Themes 28. Vulnerability Privilege Level: Subscriber and above 29. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 30. Vulnerability Scope: WordPress Plugins/Themes 31. Vulnerability Privilege Level: Subscriber and above 32. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 33. Vulnerability Scope: WordPress Plugins/Themes 34. Vulnerability Privilege Level: Subscriber and above 35. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 36. Vulnerability Scope: WordPress Plugins/Themes 37. Vulnerability Privilege Level: Subscriber and above 38. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 39. Vulnerability Scope: WordPress Plugins/Themes 40. Vulnerability Privilege Level: Subscriber and above 41. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 42. Vulnerability Scope: WordPress Plugins/Themes 43. Vulnerability Privilege Level: Subscriber and above 44. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 45. Vulnerability Scope: WordPress Plugins/Themes 46. Vulnerability Privilege Level: Subscriber and above 47. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 48. Vulnerability Scope: WordPress Plugins/Themes 49. Vulnerability Privilege Level: Subscriber and above 50. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 51. Vulnerability Scope: WordPress Plugins/Themes 52. Vulnerability Privilege Level: Subscriber and above 53. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 54. Vulnerability Scope: WordPress Plugins/Themes 55. Vulnerability Privilege Level: Subscriber and above 56. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 57. Vulnerability Scope: WordPress Plugins/Themes 58. Vulnerability Privilege Level: Subscriber and above 59. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 60. Vulnerability Scope: WordPress Plugins/Themes 61. Vulnerability Privilege Level: Subscriber and above 62. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 63. Vulnerability Scope: WordPress Plugins/Themes 64. Vulnerability Privilege Level: Subscriber and above 65. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 66. Vulnerability Scope: WordPress Plugins/Themes 67. Vulnerability Privilege Level: Subscriber and above 68. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 69. Vulnerability Scope: WordPress Plugins/Themes 70. Vulnerability Privilege Level: Subscriber and above 71. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 72. Vulnerability Scope: WordPress Plugins/Themes 73. Vulnerability Privilege Level: Subscriber and above 74. Vulnerability Impact Severity: Remote Code Execution and Privilege Escalation 75. Vulnerability Scope: WordPress Plugins/Themes 76. Vu

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Th Shop Mania <= 1.4.9 CVE-2024-10674 Arbitrary Plugin Installation

More from this source