CVE-2024-5987

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_contrast_variations' and 'save_empty_contrast_variations' functions in all versions up to, and including, 0.6.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit or delete contrast settings. Please note these issues were patched in 0.6.2.8, though it broke functionality and the vendor has not responded to our follow-ups.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-59889.8Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and CVE-2024-59899.8Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program a CVE-2024-59907.5Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automa CVE-2024-59917.5In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specificall CVE-2024-59926.5The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'upda CVE-2024-59935.4The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'upda CVE-2024-59945.4The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions CVE-2024-59958.8The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly c CVE-2024-59974.3The Duplica – Duplicate Posts, Pages, Custom Posts or Users plugin for WordPress is vulnerable to unauthorized modification of data due to a CVE-2024-59987.8A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. CVE-2024-60007.1The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability settin CVE-2024-60018.1An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an up