Vulnerability Description
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the /includes/ajax-functions.php file all versions up to, and including, 1.6.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple administrative actions, such as replying to arbitrary tickets, updating the status of any post, deleting any post, adding notes to tickets, flagging or unflagging tickets, and adding or removing ticket participants.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Logon | Kb Support | < 1.6.7 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5fb90b3b-08bd-4887-a6bThird Party Advisory
FAQ
What is CVE-2024-8548?
CVE-2024-8548 is a vulnerability with a CVSS score of 8.1 (HIGH). The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the /...
How severe is CVE-2024-8548?
CVE-2024-8548 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-8548?
Check the references section above for vendor advisories and patch information. Affected products include: Logon Kb Support.