5.4
Medium
CVE-2024-7424 The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access…
Description
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those functions intended for admin use resulting in subscribers being able to upload csv files and view the contents of MPG projects.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Multiple Page Generator Plugin – MPG 4.0 | earliest → 4.0.1 | No fix stated |
Other CVEs of Multiple Page Generator Plugin – MPG
The 12 CVEs of Multiple Page Generator Plugin – MPG →
CVE-2024-10705
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all…
5.4
Medium
CVE-2024-10672
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to…
2.7
Low
CVE-2024-47325
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle MPG…
8.5
High
CVE-2024-31301
Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects…
5.4
Medium