CVE-2024-2538

MEDIUM

Permalink Manager Lite < 2.4.3.2 - Missing Authorization

Title source: rule
STIX 2.1

Description

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.

References (3)

Core 3

Scores

CVSS v3 5.4
EPSS 0.0005
EPSS Percentile 15.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-639 CWE-862
Status published
Products (2)
mbis/Permalink Manager Lite < 2.4.3.1
permalink_manager_lite_project/permalink_manager_lite < 2.4.3.2
Published Mar 20, 2024
Tracked Since Feb 18, 2026