Skip to content
Sign in
5.3 Medium

CVE-2024-8430 The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…

Description

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_importer_creater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo content.

Affected products and versions

Product Affected versions Fixed in
Spice Starter Sites 1.2 earliest → 1.2.5 No fix stated
spice_starter_sites 1.2 earliest → 1.2.5 No fix stated

Other CVEs of Spice Starter Sites

The 2 CVEs of Spice Starter Sites →
CVE-2024-44003 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spicethemes… 7.1 High
Track this CVE