Exploitation Summary
CVE-2024-9860 has been observed exploited in the wild (reported by VulnCheck KEV).
Description
The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'import_action' and 'install_plugin_per_demo' functions in versions up to, and including, 3.3. This makes it possible for authenticated attackers with subscriber-level permissions or above, to delete or change plugin settings, import demo data, and install limited plugins.
References (2)
Core 2
Core References
Scores
CVSS v3
5.4
EPSS
0.0030
EPSS Percentile
22.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
VulnCheck KEV
2025-02-05
CWE
CWE-862
Status
published
Products (1)
QODE/Bridge Core
< 3.3
Published
Oct 12, 2024
Tracked Since
Feb 18, 2026