{"id":"CVE-2024-8427","aliases":["EUVD-2024-49167","GHSA-mxhr-5h76-4875"],"status":"published","title":"Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin \u003c= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","description":"The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00323,"percentile":0.25539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2024-09-06T06:50:54Z","modified":"2026-06-17T08:22:33Z","products":[{"vendor":"wpshuffle","product":"frontend post submission manager lite – frontend posting wordpress plugin"},{"vendor":"wpshuffle","product":"frontend_post_submission_manager"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e84b68b6-1ce8-45fb-823f-a61158aa4d21?source=cve","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/3147218/frontend-post-submission-manager-lite/trunk/includes/classes/admin/class-fpsml-ajax-admin.php","tags":["Patch"]},{"url":"https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.2/includes/classes/admin/class-fpsml-ajax-admin.php#L25","tags":["Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8427"},{"url":"https://github.com/advisories/GHSA-mxhr-5h76-4875"}],"sources":{"cve":[{"id":"CVE-2024-8427","title":"Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin \u003c= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","description":"The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms.","status":"published","published":"2024-09-06T06:50:54.701Z","modified":"2026-04-08T17:30:32.835Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:09.216761Z"}],"euvd":[{"id":"EUVD-2024-49167","description":"The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms.","status":"published","published":"2024-09-06T06:50:54Z","modified":"2026-04-08T17:30:32Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:35.429442Z"}],"ghsa":[{"id":"GHSA-mxhr-5h76-4875","title":"The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for...","description":"The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms.","status":"published","published":"2024-09-06T09:32:31Z","modified":"2024-09-06T09:32:36Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:58:11.330333Z"}],"nvd":[{"id":"CVE-2024-8427","description":"The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms.","status":"published","published":"2024-09-06T07:15:03.73Z","modified":"2026-06-17T08:22:33.62Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:24.514378Z"}]}}