Description
WordPress Plugin CiviCRM is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently read private data from the database. WordPress Plugin CiviCRM version 5.35.1 is vulnerable; prior versions are also affected.
Remediation
Update to plugin versions 5.36.1, 5.35.2, 5.33.5 ESR, or latest
References
Related Vulnerabilities
Python Integer Overflow or Wraparound Vulnerability (CVE-2008-2315)
Joomla Insufficient Verification of Data Authenticity Vulnerability (CVE-2020-15699)
WordPress Plugin OneSignal-Web Push Notifications Cross-Site Scripting (1.17.7)
MySQL CVE-2013-5908 Vulnerability (CVE-2013-5908)
Oracle JRE Incorrect Default Permissions Vulnerability (CVE-2024-20921)