CVE-2024-6799

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_module', 'deactivate_module', and 'install_module' functions in all versions up to, and including, 2.34.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install, activate, and deactivate plugins from a pre-defined list of available YITH plugins.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jul 19, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-68009.8An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity CVE-2024-68019.8A vulnerability, which was classified as critical, has been found in SourceCodester Online Student Management System 1.0. This issue affects CVE-2024-68029.8A vulnerability, which was classified as critical, was found in SourceCodester Computer Laboratory Management System 1.0. Affected is an unk CVE-2024-68039.8A vulnerability has been found in itsourcecode Document Management System 1.0 and classified as critical. Affected by this vulnerability is CVE-2024-68045.4The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and incl CVE-2024-68059.8The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may CVE-2024-68069.8The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may resul CVE-2024-68073.4A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0 and classified as problematic. Affected by this CVE-2024-68089.8A vulnerability was found in itsourcecode Simple Task List 1.0. It has been classified as critical. This affects the function insertUserReco CVE-2024-68099.8The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statemen CVE-2024-68104.4The Quiz Organizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.1 due to insu CVE-2024-68117.8IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar