CVE-2024-2538

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-253816.1There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.CVE-2024-253856.2An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial of service via the flvmeta/src/flv.c:375:21 function in flv_close.CVE-2024-253868.8Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbit CVE-2024-253888.4drivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.CVE-2024-253897.5RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;" CVE-2024-25395.4The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget '_id' attributes in all versio CVE-2024-253908.4A heap buffer overflow occurs in finsh/msh_file.c and finsh/msh.c in RT-Thread through 5.0.2.CVE-2024-253918.4A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2.CVE-2024-253925.9An out-of-bounds access occurs in utilities/var_export/var_export.c in RT-Thread through 5.0.2.CVE-2024-253939.8A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2.CVE-2024-253944.3A buffer overflow occurs in utilities/ymodem/ry_sy.c in RT-Thread through 5.0.2 because of an incorrect sprintf call or a missing '\0' chara CVE-2024-253958.8A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2.