Paper/Archive/CVE-2024-2702

CVE-2024-2702

Olive Themes Olive One Click Demo Import — WordPress Olive One Click Demo Import plugin <= 1.1.1 - Broken Access Control vulnerability

EPSS 0.6%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 48.0.480 × 209.6 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import allows importing settings and data, ultimately leading to XSS.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.

Affected

ProductAffectedFixed inSource

Olive One Click Demo Importn/a – 1.1.1–CNA

olive_one_click_demo_import≤ 1.1.1–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patchstack (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refpatchstack.com/database/vulnerability/olive-one-click-demo-import/wordpress-olive-one-click-demo-import-plugin-1-1-1-broken-access-control-vulnerability?_s_id=cve