The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ucsm_activate_lite_template_lite function in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to change the template used for the coming soon / maintenance page.
Metrics
Affected Vendors & Products
References
History
Fri, 06 Dec 2024 18:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Rstheme
Rstheme ultimate-coming-soon |
|
CPEs | cpe:2.3:a:rstheme:ultimate-coming-soon:*:*:*:*:*:*:*:* | |
Vendors & Products |
Rstheme
Rstheme ultimate-coming-soon |
|
Metrics |
ssvc
|
Fri, 06 Dec 2024 08:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ucsm_activate_lite_template_lite function in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to change the template used for the coming soon / maintenance page. | |
Title | Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Unauthenticated Template Activation | |
Weaknesses | CWE-862 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-12-06T08:24:56.298Z
Updated: 2024-12-06T17:18:35.266Z
Reserved: 2024-10-09T19:01:00.857Z
Link: CVE-2024-9706
Vulnrichment
Updated: 2024-12-06T17:18:27.880Z
NVD
Status : Received
Published: 2024-12-06T09:15:08.727
Modified: 2024-12-06T09:15:08.727
Link: CVE-2024-9706
Redhat
No data.