CVE-2024-11851

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jan 15, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-118524.3The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulner CVE-2024-118536.4The jAlbum Bridge plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ar’ parameter in all versions up to, and includ CVE-2024-118546.4The Listdom – Business Directory and Classified Ads Listings WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Script CVE-2024-118556.4The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ pa CVE-2024-118563.7A security vulnerability in HPE IceWall products could be exploited remotely to cause Unauthorized Data Modification.CVE-2024-118577.8Bluetooth HCI Adaptor from Realtek has a Link Following vulnerability. Local attackers with regular privileges can create a symbolic link wi CVE-2024-118587.8A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble A CVE-2024-118598.4DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link libr CVE-2024-11865.5A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0. This vulnerability affects unknown code of the com CVE-2024-118606.5A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects an unknown par CVE-2024-118619.8EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access.CVE-2024-118625.1Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption