Websiteinwp Blogpoet: Missing authorization vulnerability (CVE-2024-43998)

CVE-2024-43998 is a missing authorization vulnerability in the Blogpoet WordPress theme versions up to 1.0.3. The vulnerability allows unauthenticated attackers to access and interact with functionality not properly constrained by access control lists. A public exploit script is available that facilitates the unauthorized installation and activation of plugins on target WordPress sites.

Impact

Successful exploitation allows an unauthenticated attacker to install and activate arbitrary plugins, potentially leading to full site compromise, remote code execution (via malicious plugins), or unauthorized configuration changes.

Recommendation

• Inventory all WordPress instances running the Blogpoet theme.
• Update the Blogpoet theme to version 1.0.4 or later immediately.
• If immediate patching is not possible, disable the theme until an update can be applied.
• Monitor web server logs for suspicious requests involving plugin installation or activation endpoints associated with the Blogpoet theme.