Vulnerabilities > CVE-2024-11911 - Missing Authorization vulnerability in Themeum WP Crowdfunding

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

themeum

CWE-862

NVD

Published: 2024-12-13

Updated: 2025-02-11

Summary

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install WooCommerce. This has a limited impact on most sites because WooCommerce is a requirement.

Vulnerable Configurations

Part	Description	Count
Application	Themeum Themeum WP Crowdfunding 1.0 Themeum WP Crowdfunding 1.1 Themeum WP Crowdfunding 1.2 Themeum WP Crowdfunding 1.3 Themeum WP Crowdfunding 1.4 Themeum WP Crowdfunding 1.5 Themeum WP Crowdfunding 1.6.0 Themeum WP Crowdfunding 1.6.1 Themeum WP Crowdfunding 1.6.2 Themeum WP Crowdfunding 1.6.3 Themeum WP Crowdfunding 1.6.4 Themeum WP Crowdfunding 1.6.5 Themeum WP Crowdfunding 1.6.6 Themeum WP Crowdfunding 1.6.7 Themeum WP Crowdfunding 1.6.8 Themeum WP Crowdfunding 1.6.9 Themeum WP Crowdfunding 1.7.0 Themeum WP Crowdfunding 1.7.1 Themeum WP Crowdfunding 1.7.2 Themeum WP Crowdfunding 1.7.3 Themeum WP Crowdfunding 1.7.4 Themeum WP Crowdfunding 1.7.5 Themeum WP Crowdfunding 1.7.6 Themeum WP Crowdfunding 1.7.7 Themeum WP Crowdfunding 1.8.0 Themeum WP Crowdfunding 1.8.1 Themeum WP Crowdfunding 1.8.2 Themeum WP Crowdfunding 1.8.3 Themeum WP Crowdfunding 1.8.5 Themeum WP Crowdfunding 1.8.6 Themeum WP Crowdfunding 1.8.7 Themeum WP Crowdfunding 1.8.8 Themeum WP Crowdfunding 1.8.9 Themeum WP Crowdfunding 1.9.1 Themeum WP Crowdfunding 2.0.0 Themeum WP Crowdfunding 2.0.1 Themeum WP Crowdfunding 2.0.2 Themeum WP Crowdfunding 2.0.4 Themeum WP Crowdfunding 2.0.5 Themeum WP Crowdfunding 2.0.6 Themeum WP Crowdfunding 2.0.7 Themeum WP Crowdfunding 2.0.8 Themeum WP Crowdfunding 2.0.9 Themeum WP Crowdfunding 2.1.0 Themeum WP Crowdfunding 2.1.1 Themeum WP Crowdfunding 2.1.2 Themeum WP Crowdfunding 2.1.3 Themeum WP Crowdfunding 2.1.4 Themeum WP Crowdfunding 2.1.5 Themeum WP Crowdfunding 2.1.6 Themeum WP Crowdfunding 2.1.7 Themeum WP Crowdfunding 2.1.8 Themeum WP Crowdfunding 2.1.9 Themeum WP Crowdfunding 2.1.10	54

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References