SB2025012732 - Multiple vulnerabilities in NitroPack plugin for WordPress

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2024-11851)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to a missing capability check on the nitropack_rml_notification function. A remote user can update arbitrary transients.

2) Missing Authorization (CVE-ID: CVE-2024-11848)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to a missing capability check on the "nitropack_dismiss_notice_forever" AJAX action. A remote user can update or modify arbitrary options.

Remediation

Install update from vendor's website.

References

• https://plugins.trac.wordpress.org/changeset/3211235/nitropack
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8945bae7-2224-4d9f-b693-10c94c94dea0?source=cve
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1b06d0-f348-4a8b-8730-a87d8e2ba2a1?source=cve