CVE-2024-1109

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracking data and podcast information.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Feb 7, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-110907.5The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incCVE-2024-110916.4The Support SVG – Upload svg files in wordpress without hassle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST APCVE-2024-110926.4The SVGPlus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and incluCVE-2024-110935.5The SG Helper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.0 due to insufficient inpuCVE-2024-110945.3The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the CVE-2024-110956.4The Visualmodo Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up tCVE-2024-110966.5A vulnerability, which was classified as critical, was found in code-projects Task Manager 1.0. This affects an unknown part of the file /neCVE-2024-110975.5A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as problematic. This vulnerability affeCVE-2024-110985.5The SVG Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and incCVE-2024-110999.8A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of theCVE-2024-11105.3The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on tCVE-2024-111009.8A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been declared as critical. Affected by this vulnerab
CVE-2024-1109: Medium severity, CVSS 5.3 | Vulnix