CVE-2024-6799

MEDIUM

YITH Essential Kit for WooCommerce #1 <2.34.0 - Privilege Escalation

Title source: llm
STIX 2.1

Description

The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_module', 'deactivate_module', and 'install_module' functions in all versions up to, and including, 2.34.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install, activate, and deactivate plugins from a pre-defined list of available YITH plugins.

References (5)

Core 5

Scores

CVSS v3 4.3
EPSS 0.0033
EPSS Percentile 24.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
yithemes/YITH Essential Kit for WooCommerce #1 < 2.34.0
yithemes/yith_essential_kit_for_woocommerce < 2.35.0
Published Jul 19, 2024
Tracked Since Feb 18, 2026