CVE-2024-1645

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrations function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to export payment data collected by this plugin.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-16468.2parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks CVE-2024-16477.5Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application doe CVE-2024-16487.5electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application CVE-2024-16494.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj CVE-2024-16504.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj CVE-2024-16519.8Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to inse CVE-2024-16524.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj CVE-2024-16534.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAj CVE-2024-16547.2This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have a CVE-2024-16558.8Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary s CVE-2024-16562.6Affected versions of Octopus Server had a weak content security policy.CVE-2024-16578.1A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebo