CVE-2024-6392

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-6392", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2024-06-27T16:18:22.936Z", "datePublished": "2024-07-11T21:31:34.282Z", "dateUpdated": "2026-04-08T16:41:42.615Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:42.615Z"}, "affected": [{"vendor": "sirv", "product": "Image Optimizer, Resizer and CDN \u2013 Sirv", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.2.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Image Optimizer, Resizer and CDN \u2013 Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one."}], "title": "Image Optimizer, Resizer and CDN \u2013 Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/229490c3-d820-4831-b105-a429512c2c60?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5197"}, {"url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5338"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2024-06-19T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2024-07-11T09:29:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-12T14:56:00.528823Z", "id": "CVE-2024-6392", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T20:29:00.310Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:41:03.377Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/229490c3-d820-4831-b105-a429512c2c60?source=cve", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5197", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5338", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/229490c3-d820-4831-b105-a429512c2c60?source=cve", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5197", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5338", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:41:03.377Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6392", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-12T14:56:00.528823Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T14:56:09.581Z"}}], "cna": {"title": "Image Optimizer, Resizer and CDN \u2013 Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "sirv", "product": "Image Optimizer, Resizer and CDN \u2013 Sirv", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.2.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-06-19T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2024-07-11T09:29:49.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/229490c3-d820-4831-b105-a429512c2c60?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5197"}, {"url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5338"}], "descriptions": [{"lang": "en", "value": "The Image Optimizer, Resizer and CDN \u2013 Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:42.615Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6392", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:41:42.615Z", "dateReserved": "2024-06-27T16:18:22.936Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2024-07-11T21:31:34.282Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Image Optimizer, Resizer and CDN \u2013 Sirv", "vendor": "sirv", "versions": [{"lessThanOrEqual": "7.2.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sirv:sirv:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "479CF10B-EE73-452F-BA16-3E26143812EE", "versionEndExcluding": "7.2.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Image Optimizer, Resizer and CDN \u2013 Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one."}, {"lang": "es", "value": "El complemento Image Optimizer, Resizer y CDN \u2013 Sirv para WordPress es vulnerable a modificaciones no autorizadas de la configuraci\u00f3n del complemento debido a la falta de comprobaciones de capacidad en las funciones del complemento en todas las versiones hasta la 7.2.7 incluida. Esto hace posible que los atacantes autenticados, con acceso de nivel de suscriptor y superior, cambien la cuenta Sirv conectada a una controlada por el atacante."}], "id": "CVE-2024-6392", "lastModified": "2026-06-17T08:17:55.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-6392", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-07-12T14:56:00.528823Z", "version": "2.0.3"}}]}, "published": "2024-07-11T22:15:02.820", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5197"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5338"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/229490c3-d820-4831-b105-a429512c2c60?source=cve"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5197"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5338"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/229490c3-d820-4831-b105-a429512c2c60?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{}