CVE-2024-1860

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_add_whitelist() function in all versions up to, and including, 4.51. This makes it possible for unauthenticated attackers to add their IP Address to the whitelist circumventing protection

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
sminozziDisable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan<= 4.51
sminozzidisable_json_api_login_lockdown_xml_rpc_pingback_stop_user_enumeration_anit_hacker_scan<= 4.51

References

Timeline

Published
Feb 28, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-18614.3The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthoCVE-2024-18626.5The WooCommerce Add to Cart Custom Redirect plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to CVE-2024-18639.8Sante PACS Server Token Endpoint SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arCVE-2024-18677.8G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileCVE-2024-18687.8G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileCVE-2024-18697.5Certain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when usinCVE-2024-18704.3The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the caCVE-2024-18715.4A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. Affected is an unknown funCVE-2024-18728.8The Button plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.27 via deserialization of unCVE-2024-18739.1parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in versionCVE-2024-18749.4In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufCVE-2024-18758.8A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown proc