Plataforma
wordpress
Componente
woocommerce-products-filter
Corrigido em
1.3.7
CVE-2024-43121 describes a Privilege Escalation vulnerability within the HUSKY WordPress plugin. This flaw allows attackers to bypass intended access controls and gain elevated privileges on a WordPress installation. Versions of HUSKY prior to 1.3.7 are affected, and a patch has been released to address the issue. Prompt action is recommended to mitigate potential risks.
Successful exploitation of CVE-2024-43121 allows an attacker to escalate their privileges within the WordPress environment. This could involve gaining administrator access, enabling them to modify site content, install malicious plugins, steal sensitive data (user credentials, database information), or even completely compromise the server. The impact is particularly severe because WordPress is frequently used to host business-critical applications and sensitive data, making it a high-value target for attackers. A successful attack could lead to data breaches, website defacement, and significant reputational damage.
CVE-2024-43121 was publicly disclosed on August 13, 2024. The vulnerability's criticality (CVSS 9.1) suggests a high probability of exploitation. As of this writing, there are no publicly available proof-of-concept exploits, but the severity and ease of privilege escalation often make these vulnerabilities attractive targets for attackers. Monitor security advisories and threat intelligence feeds for any indications of active exploitation campaigns.
WordPress websites utilizing the HUSKY plugin, particularly those running versions prior to 1.3.7, are at risk. Shared hosting environments where multiple websites share the same server are especially vulnerable, as a compromise of one site could potentially lead to the compromise of others. Websites with weak user access controls or those that have not been regularly updated are also at increased risk.
• wordpress / composer / npm:
wp plugin list --status=inactive | grep husky• wordpress / composer / npm:
wp plugin update husky --all• wordpress / composer / npm:
wp plugin status husky• generic web: Check WordPress access logs for unusual user activity or attempts to access administrative functions from unauthorized IP addresses.
disclosure
Status do Exploit
EPSS
0.36% (percentil 58%)
CISA SSVC
Vetor CVSS
The primary mitigation for CVE-2024-43121 is to immediately upgrade the HUSKY WordPress plugin to version 1.3.7 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These might include restricting user roles and permissions to limit the potential impact of a successful exploit. Monitor WordPress access logs for suspicious activity, particularly attempts to access restricted areas of the site. After upgrading, verify the fix by attempting to perform actions that would previously have been restricted based on user roles; confirm that access is now properly controlled.
Actualice el plugin HUSKY a la última versión disponible. La vulnerabilidad de escalada de privilegios se ha corregido en versiones posteriores a la 1.3.6.1. Consulte el registro de cambios del plugin para obtener más detalles sobre la corrección.
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2024-43121 is a critical vulnerability in the HUSKY WordPress plugin that allows attackers to gain elevated privileges, potentially compromising the entire site. It affects versions up to 1.3.6.1.
Yes, if you are using the HUSKY WordPress plugin and have not upgraded to version 1.3.7 or later, you are vulnerable to this privilege escalation attack.
The recommended fix is to immediately update the HUSKY WordPress plugin to version 1.3.7 or a later version. If upgrading is not possible, implement temporary access restrictions.
While there are no publicly known exploits currently, the high severity of the vulnerability suggests a high probability of exploitation. Continuous monitoring is advised.
Refer to the official HUSKY plugin documentation and WordPress security announcements for the latest advisory and updates regarding CVE-2024-43121.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.