Websiteinwp - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/websiteinwp/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 05:40:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWebsiteinwp Blogpoet: Missing authorization vulnerability (CVE-2024-43998)https://feed.craftedsignal.io/briefs/2026-10-cve-2024-43998/Sun, 25 Oct 2026 05:40:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2024-43998/A missing authorization vulnerability in the Websiteinwp Blogpoet WordPress theme (versions < 1.0.4) allows unauthenticated users to access restricted functionality, including unauthorized plugin installation and activation.CVE-2024-43998 is a missing authorization vulnerability in the Blogpoet WordPress theme versions up to 1.0.3. The vulnerability allows unauthenticated attackers to access and interact with functionality not properly constrained by access control lists. A public exploit script is available that facilitates the unauthorized installation and activation of plugins on target WordPress sites.

Impact

Successful exploitation allows an unauthenticated attacker to install and activate arbitrary plugins, potentially leading to full site compromise, remote code execution (via malicious plugins), or unauthorized configuration changes.

Recommendation

  • Inventory all WordPress instances running the Blogpoet theme.
  • Update the Blogpoet theme to version 1.0.4 or later immediately.
  • If immediate patching is not possible, disable the theme until an update can be applied.
  • Monitor web server logs for suspicious requests involving plugin installation or activation endpoints associated with the Blogpoet theme.
]]>highadvisory