Vulnerabilities > CVE-2024-7836 - Incorrect Authorization vulnerability in Themify Builder

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

themify

CWE-863

NVD

Published: 2024-08-22

Updated: 2024-11-20

Summary

The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate and view private or draft posts created by other users that otherwise shouldn't be accessible to them.

Vulnerable Configurations

Part	Description	Count
Application	Themify Themify Builder 4.5.1 Themify Builder 4.5.2 Themify Builder 4.5.3 Themify Builder 4.5.4 Themify Builder 4.5.5 Themify Builder 4.5.6 Themify Builder 4.5.7 Themify Builder 4.5.8 Themify Builder 4.5.9 Themify Builder 4.6.0 Themify Builder 4.6.1 Themify Builder 4.6.2 Themify Builder 4.6.3 Themify Builder 4.6.4 Themify Builder 4.6.5 Themify Builder 4.6.6 Themify Builder 4.6.7 Themify Builder 4.6.8 Themify Builder 4.6.9 Themify Builder 4.7.0 Themify Builder 4.7.1 Themify Builder 4.7.2 Themify Builder 4.7.3 Themify Builder 5.0.0 Themify Builder 5.0.1 Themify Builder 5.0.2 Themify Builder 5.0.3 Themify Builder 5.0.4 Themify Builder 5.0.5 Themify Builder 5.0.6 Themify Builder 5.0.7 Themify Builder 5.0.8 Themify Builder 5.0.9 Themify Builder 5.1.0 Themify Builder 5.1.1 Themify Builder 5.1.2 Themify Builder 5.1.3 Themify Builder 5.3.0 Themify Builder 5.3.1 Themify Builder 5.3.2 Themify Builder 5.3.3 Themify Builder 5.3.4 Themify Builder 5.3.5 Themify Builder 5.3.6 Themify Builder 5.3.7	45

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References