CVE-2024-1994

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Image Watermark plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the watermark_action_ajax() function in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to apply and remove watermarks from images.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-19954.3The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relationaCVE-2024-19965.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's IHover widget link in all versionsCVE-2024-19975.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the MeCVE-2024-19995.4The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TesCVE-2024-20005.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi ScCVE-2024-200016.7In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SysteCVE-2024-200026.7In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SysteCVE-2024-200037.5In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent CVE-2024-200047.5In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent CVE-2024-200058.2In da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with SystemCVE-2024-200066.7In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System eCVE-2024-200077.5In mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation of privilege with no a