CVE-2024-10124
CriticalSummary
Wtyczka Vayu Blocks – Gutenberg Blocks dla WordPress i WooCommerce jest podatna na nieautoryzowaną instalację i aktywację dowolnych wtyczek z powodu braku sprawdzenia uprawnień w funkcji tp_install() we wszystkich wersjach do i włącznie z 1.1.1. Umożliwia to nieautoryzowanym atakującym instalację i aktywację dowolnych wtyczek, co może prowadzić do zdalnego wykonania kodu, jeśli inna podatna wtyczka jest zainstalowana i aktywowana.
Risk Assessment
Organizacje mogą być narażone na poważne zagrożenia związane z bezpieczeństwem, w tym zdalne wykonanie kodu, co może prowadzić do utraty danych lub przejęcia kontroli nad systemem. Atakujący mogą wykorzystać tę podatność do instalacji złośliwego oprogramowania.
Recommendation
Zaleca się aktualizację wtyczki do najnowszej wersji, aby załatać tę podatność. Dodatkowo, warto przeprowadzić audyt zainstalowanych wtyczek w celu identyfikacji i usunięcia potencjalnie niebezpiecznych komponentów.
Related vulnerabilities
- CVE-2026-51720Critical
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove firewall filter rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-76133Critical
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate unauthorized access.
- CVE-2026-73819Critical
The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventing legitimate administrators from managing the device.
- CVE-2026-82970Critical
The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (part of WP Legal Pages) has an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files. This issue affects versions from n/a through 4.4.1.
- CVE-2026-59111Critical
An OS command injection vulnerability in the eObčanka-Identifikace application (DIA) on MacOS allows an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.
- CVE-2026-51681Critical
Incorrect access control in the setRemoteCfg function of TOTOLINK T6 allows unauthenticated attackers to expose WAN-side administration via a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51680Critical
Incorrect access control in the setLedCfg function of TOTOLINK T6 allows unauthenticated attackers to modify LED behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51679Critical
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 allows unauthenticated attackers to change the administrator account via a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-82695Critical
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-82694Critical
A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. This vulnerability was partially patched in version 1.1.1.