CVE-2024-5468

MEDIUM

WordPress Header Builder Plugin - Pearl <1.3.7 - Info Disclosure

Title source: llm

Description

The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stm_hb_delete() function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to delete arbitrary options that can be used to perform a denial of service attack on a site.

References (2)

Core 2

Core References

Product

https://plugins.trac.wordpress.org/browser/pearl-header-builder/tags/1.3.7/includes/helpers.php#L304

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e770e0-1a39-4946-838b-4fd1f1dea1c8?source=cve

Scores

CVSS v3 6.5

EPSS 0.0037

EPSS Percentile 29.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

stylemix/Pearl – Header Builder < 1.3.7

stylemix/WordPress Header Builder Plugin – Pearl < 1.3.7

Published Jun 12, 2024

Tracked Since Feb 18, 2026