CVE-2024-6591

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jul 27, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-65929.1An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Age CVE-2024-65939.1Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with net CVE-2024-65947.5Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash whil CVE-2024-65955.3An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and CVE-2024-65969.8An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.CVE-2024-65986.5A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticat CVE-2024-65994.3The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the aja CVE-2024-66006.3Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 819 CVE-2024-66014.7A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < CVE-2024-66029.8A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 11 CVE-2024-66037.4In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption CVE-2024-66047.5Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corrupti