CVE-2024-3607

MEDIUM

PropertyHive <= 2.0.12 - Authenticated Arbitrary Post Deletion via Missing Capability Check

Title source: llm

Description

The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() function in all versions up to, and including, 2.0.12. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts

References (2)

Core 2

Core References

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3075163%40propertyhive&new=3075163%40propertyhive&sfp_email=&sfph_mail=#file11

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d52ced-807b-48c0-bb7a-e40d143ae5d3?source=cve

Scores

CVSS v3 4.3

EPSS 0.0062

EPSS Percentile 45.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

propertyhive/Property Hive < 2.0.12

wp-property-hive/propertyhive < 2.0.13

Published May 02, 2024

Tracked Since Feb 18, 2026