{"id":"CVE-2024-10078","aliases":["EUVD-2024-32894","GHSA-cgj8-gpqh-35qr"],"status":"published","title":"WP Easy Post Types \u003c= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions","description":"The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00411,"percentile":0.35636,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2024-10-18T07:35:26Z","modified":"2026-06-17T06:54:52Z","products":[{"vendor":"chertz","product":"wp easy post types"},{"vendor":"newsignature","product":"wp_easy_post_types"},{"vendor":"wp_easy_post_types_project","product":"wp_easy_post_types"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d12c4b1c-23d0-430f-a6ea-0a3ab487ed10?source=cve","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L111","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L112","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L113","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L114","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L115","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L116","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L117","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L118","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L119","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L120","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L121","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L122","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L123","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L124","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L125","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L126","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L127","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L128","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L129","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L130","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L131","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L132","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L133","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L134","tags":["Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10078"},{"url":"https://github.com/advisories/GHSA-cgj8-gpqh-35qr"}],"sources":{"cve":[{"id":"CVE-2024-10078","title":"WP Easy Post Types \u003c= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions","description":"The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.","status":"published","published":"2024-10-18T07:35:26.905Z","modified":"2026-04-08T17:25:07.056Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:01.972857Z"}],"euvd":[{"id":"EUVD-2024-32894","description":"The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.","status":"published","published":"2024-10-18T07:35:26Z","modified":"2026-04-08T17:25:07Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:24:39.238357Z"}],"ghsa":[{"id":"GHSA-cgj8-gpqh-35qr","title":"The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification,...","description":"The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.","status":"published","published":"2024-10-18T09:31:26Z","modified":"2024-10-18T09:31:33Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:58:33.183024Z"}],"nvd":[{"id":"CVE-2024-10078","description":"The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.","status":"published","published":"2024-10-18T08:15:04.06Z","modified":"2026-06-17T06:54:52.177Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:32.45889Z"}]}}