CVE-2024-6591

MEDIUM

Ultimate WordPress Auction Plugin <4.2.6 - XSS

Title source: llm

Description

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.

References (3)

[Product] https://plugins.trac.wordpress.org/browser/ultimate-auction/trunk/ultimate-auction.php#L119

[Product] https://plugins.trac.wordpress.org/browser/ultimate-auction/trunk/ultimate-auction.php#L93

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/534a5d1d-cc34-4d84-b3a3-bf2282718656?source=cve

Scores

CVSS v3 5.8

EPSS 0.0052

EPSS Percentile 66.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Classification

CWE

CWE-862

Status draft

Timeline

Published Jul 27, 2024

Tracked Since Feb 18, 2026