{"id":"CVE-2024-1072","aliases":["EUVD-2024-16847","GHSA-3c4g-j683-8mx6"],"status":"published","title":"Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode \u003c= 6.15.21 - Missing Authorization via seedprod_lite_new_lpage","description":"The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0068,"percentile":0.52681,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2024-02-05T21:21:50Z","modified":"2026-06-17T07:03:22Z","products":[{"vendor":"seedprod","product":"website builder by seedprod — theme builder, landing page builder, coming soon page, maintenance mode"},{"vendor":"seedprod","product":"website_builder_by_seedprod"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78d7920b-3e20-43c7-a522-72bac824c2cb?source=cve","tags":["x_transferred","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/3029567/coming-soon/trunk/app/lpage.php","tags":["x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1072"},{"url":"https://github.com/advisories/GHSA-3c4g-j683-8mx6"}],"sources":{"cve":[{"id":"CVE-2024-1072","title":"Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode \u003c= 6.15.21 - Missing Authorization via seedprod_lite_new_lpage","description":"The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.","status":"published","published":"2024-02-05T21:21:50.961Z","modified":"2026-04-08T17:01:58.597Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:17.865042Z"}],"euvd":[{"id":"EUVD-2024-16847","description":"The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.","status":"published","published":"2024-02-05T21:21:50Z","modified":"2026-04-08T17:01:58Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:24:52.902902Z"}],"ghsa":[{"id":"GHSA-3c4g-j683-8mx6","title":"The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page,...","description":"The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.","status":"published","published":"2024-02-06T00:30:27Z","modified":"2024-02-13T21:30:29Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:55:37.270786Z"}],"nvd":[{"id":"CVE-2024-1072","description":"The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.","status":"published","published":"2024-02-05T22:16:07.1Z","modified":"2026-06-17T07:03:22.79Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:09:34.891666Z"}]}}