Threat Entry Updated 2024-09-06

CVE-2024-7381 - Cf Geoplugin

The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.

PLUGIN Cf Geoplugin

CVE-2024-7381

MEDIUM CVSS 5.3 2024-09-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-09-06

CVE-2024-7380 - Cf Geoplugin

The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and ajax__geolocate_remove_menu functions in all versions up to, and including, 8.6.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete WordPress menus.

PLUGIN Cf Geoplugin

CVE-2024-7380

MEDIUM CVSS 4.3 2024-09-05

Risk Score

Open Full Technical Breakdown