CVE-2024-0829

MediumCVSS 4.3

Published: 13/03/2024(UTC)Updated: 11/08/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

42th percentile - higher than 42% of all known CVEs

Summary

The Comments Extra Fields For Post, Pages and CPT plugin for WordPress up to version 5.0 is vulnerable to Missing Authorization. Several AJAX actions lack proper capability checks, allowing authenticated attackers with subscriber access or higher to modify comment form fields and update plugin settings.

Risk Assessment

An attacker can unauthorizedly change plugin configuration and form fields, potentially leading to data integrity issues or injection of malicious content.

Recommendation

Update the plugin to the latest version that includes authorization fixes. If not available, restrict access to AJAX actions for unauthorized roles.

Other vulnerabilities in Comments Extra Fields For Post, Pages and CPT

CVE-2024-0830Medium
The Comments Extra Fields For Post, Pages and CPT plugin for WordPress up to version 5.0 is vulnerable to Cross-Site Request Forgery. Several AJAX actions lack nonce validation, allowing unauthenticated attackers to invoke them via a forged request if they trick a site administrator into clicking a link. This can lead to modification of comment form fields and plugin settings.

Original NVD description (English source)

The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0. This is due to missing or incorrect capability checks on several ajax actions. This makes it possible for authenticated attackers, with subscriber access or higher, to invoke those actions. As a result, they may modify comment form fields and update plugin settings.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS