CVE-2024-1870

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to, and including, 1.0.260. This makes it possible for authenticated attackers, with subscriber access or higher, to update the license key.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
extendthemes	Colibri Page Builder	<= 1.0.260

References

Timeline

Published: Mar 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-18715.4A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. Affected is an unknown fun CVE-2024-18728.8The Button plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.27 via deserialization of un CVE-2024-18739.1parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version CVE-2024-18749.4In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insuf CVE-2024-18758.8A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown proc CVE-2024-18769.8A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown funct CVE-2024-18778.8A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability CVE-2024-18788.8A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some un CVE-2024-18798.8A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary comma CVE-2024-18807.8An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecti CVE-2024-18819.8AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command CVE-2024-18827.2This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code executio