The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infility_global_ajax function in all versions up to, and including, 2.9.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options and potentially break the site.
References
Configurations
History
05 Jun 2025, 15:41
Type | Values Removed | Values Added |
---|---|---|
References | () https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/class/action.class.php#L80 - Product | |
References | () https://plugins.trac.wordpress.org/browser/infility-global/trunk/infility_global.php#L121 - Product | |
References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/d0fd1c19-b752-4562-9365-165d709b91b2?source=cve - Third Party Advisory | |
Summary |
|
|
First Time |
Infility infility Global
Infility |
|
CPE | cpe:2.3:a:infility:infility_global:*:*:*:*:*:wordpress:*:* |
07 Jan 2025, 05:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2025-01-07 05:15
Updated : 2025-06-05 15:41
NVD link : CVE-2024-11496
Mitre link : CVE-2024-11496
CVE.ORG link : CVE-2024-11496
JSON object : View
Products Affected
infility
- infility_global
CWE
CWE-862
Missing Authorization