CVE-2024-2543

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639 CWE-862

Affected software

Vendor	Product	Versions
mbis	Permalink Manager Lite	<= 2.4.3.1

References

https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894Exploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/3053899/Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cveThird Party Advisory
https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894Exploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/3053899/Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cveThird Party Advisory

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-254317.8An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges CVE-2024-254345.4A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload i CVE-2024-254356.1A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a cr CVE-2024-254366.1A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTM CVE-2024-254386.1A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTM CVE-2024-25446.4The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check CVE-2024-254427.8An issue in the HuginBase::PanoramaMemento::loadPTScript function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via pa CVE-2024-254437.8An issue in the HuginBase::ImageVariable<double>::linkWith function of Hugin v2022.0.0 allows attackers to cause a heap-use-after-free via p CVE-2024-254457.8Improper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure.CVE-2024-254467.8An issue in the HuginBase::PTools::setDestImage function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a c CVE-2024-254478.8An issue in the imlib_load_image_with_error_return function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a CVE-2024-254488.8An issue in the imlib_free_image_and_decache function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafte