{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/websiteinwp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:websiteinwp:blogpoet:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":6.5,"id":"CVE-2024-43998"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Blogpoet (\u003c 1.0.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Websiteinwp"],"content_html":"\u003cp\u003eCVE-2024-43998 is a missing authorization vulnerability in the Blogpoet WordPress theme versions up to 1.0.3. The vulnerability allows unauthenticated attackers to access and interact with functionality not properly constrained by access control lists. A public exploit script is available that facilitates the unauthorized installation and activation of plugins on target WordPress sites.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to install and activate arbitrary plugins, potentially leading to full site compromise, remote code execution (via malicious plugins), or unauthorized configuration changes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all WordPress instances running the Blogpoet theme.\u003c/li\u003e\n\u003cli\u003eUpdate the Blogpoet theme to version 1.0.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, disable the theme until an update can be applied.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious requests involving plugin installation or activation endpoints associated with the Blogpoet theme.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T05:40:33Z","date_published":"2026-10-25T05:40:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-43998/","summary":"A missing authorization vulnerability in the Websiteinwp Blogpoet WordPress theme (versions \u003c 1.0.4) allows unauthenticated users to access restricted functionality, including unauthorized plugin installation and activation.","title":"Websiteinwp Blogpoet: Missing authorization vulnerability (CVE-2024-43998)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-43998/"}],"language":"en","title":"CraftedSignal Threat Feed - Websiteinwp","version":"https://jsonfeed.org/version/1.1"}