CVE-2024-12329: Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to access invoices and transaction logs
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12329?
The severity of CVE-2024-12329 is considered high due to the risk of unauthorized data access by authenticated attackers.
How do I fix CVE-2024-12329?
To fix CVE-2024-12329, update the Essential Real Estate plugin to version 5.1.7 or later, where the capability checks have been implemented.
Who is affected by CVE-2024-12329?
Authenticated users with Contributor-level access are affected by CVE-2024-12329, as they can exploit the vulnerability to access unauthorized data.
What versions of the Essential Real Estate plugin are impacted by CVE-2024-12329?
All versions of the Essential Real Estate plugin up to and including 5.1.6 are impacted by CVE-2024-12329.
What is the type of vulnerability in CVE-2024-12329?
CVE-2024-12329 is a vulnerability related to unauthorized access due to missing capability checks.