Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

7,384 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-43302

    WordPress Fonts plugin <= 3.7.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fonts Plugin Fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fonts: from n/a through 3.7.7.

    Fonts Plugin Fonts
  • Medium 5.4
    CVE-2024-43312

    WordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.1.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.1.9.

    wpclever WPC Frequently Bought Together for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2024-43310

    WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in UkrSolution Print Barcode Labels for your WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through…

    UKR Solution Print Barcode Labels for your WooCommerce products/orders Web / CMS
  • Medium 4.3
    CVE-2024-43314

    WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.9.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.3.

    Gabe Livan Asset CleanUp: Page Speed Booster
  • Medium 4.3
    CVE-2024-43332

    WordPress Photo Engine plugin <= 6.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jordy Meow Photo Engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Engine: from n/a through 6.4.0.

    Jordy Meow Photo Engine
  • Medium 5.3
    CVE-2024-43323

    WordPress ReviewX plugin <= 1.6.28 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ReviewX ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.28.

    ReviewX ReviewX
  • Medium 4.3
    CVE-2024-43343

    WordPress Order Tracking – WordPress Status Tracking Plugin plugin < 3.3.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Etoile Web Design Order Tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Order Tracking: from n/a through 3.3.12.

    Etoile Web Design Order Tracking
  • Medium 6.5
    CVE-2024-43341

    WordPress Hello Agency theme <= 1.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hello Agency: from n/a through 1.0.5.

    CozyThemes Hello Agency
  • Medium 4.3
    CVE-2024-43355

    WordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BearDev JoomSport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JoomSport: from n/a through 5.3.0.

    Beardev JoomSport
  • Medium 5.3
    CVE-2024-43919 Public exploit Scanner template EPSS 45%

    WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability

    Access Control vulnerability in YARPP YARPP allows . This issue affects YARPP: from n/a through 5.30.10.

    YARPP YARPP
  • Medium 5.3
    CVE-2024-43923

    WordPress Timetics plugin <= 1.0.23 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Timetics: from n/a through 1.0.23.

    Arraytics Timetics
  • Medium 5.4
    CVE-2024-43928

    WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in eyecix JobSearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through 2.5.4.

    EyeCix Technologies JobSearch Web / CMS
  • Medium 4.3
    CVE-2024-43925

    WordPress Envira Gallery Lite plugin <= 1.8.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.14.

    Envira Gallery Team Envira Photo Gallery
  • Medium 6.5
    CVE-2024-43929

    WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in eyecix JobSearch allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JobSearch: from n/a through 2.5.4.

    EyeCix Technologies JobSearch Web / CMS
  • Medium 6.5
    CVE-2024-43932

    WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.2.

    POSIMYTH The Plus Addons for Elementor Page Builder Lite
  • Medium 6.4
    CVE-2024-43937

    WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability

    Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10.

    Themeum WP Crowdfunding
  • Medium 5.4
    CVE-2024-43962

    WordPress LWS Affiliation plugin <= 2.3.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LWS LWS Affiliation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LWS Affiliation: from n/a through 2.3.4.

    LWS LWS Affiliation
  • Medium 6.5
    CVE-2024-43956

    WordPress MemberPress plugin <= 1.11.34 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Caseproof, LLC Memberpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberpress: from n/a through 1.11.34.

    Caseproof Memberpress
  • Medium 4.3
    CVE-2024-43968

    WordPress Newspack plugin < 3.8.7 - Broken Access Control vulnerability

    Broken Access Control vulnerability in Automattic Newspack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack: from n/a through 3.8.6.

    Automattic Newspack
  • Medium 6.5
    CVE-2024-43974

    WordPress ReviveNews theme <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2.

    CozyThemes ReviveNews
  • Medium 4.3
    CVE-2024-43973

    WordPress GetPaid plugin <= 2.8.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through <= 2.8.11.

    Stiofan GetPaid
  • Medium 6.5
    CVE-2024-43980

    WordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: from n/a through 1.4.1.

    CozyThemes Fota WP
  • Medium 6.5
    CVE-2024-43979

    WordPress Blockbooster theme <= 1.0.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10.

    CozyThemes Blockbooster
  • Medium 4.3
    CVE-2024-43981

    WordPress GeoDirectory plugin <= 2.3.70 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.

    AyeCode – WP Business Directory Plugins GeoDirectory
  • Medium 6.5
    CVE-2024-43998 Public exploit

    WordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3.

    WebsiteinWP Blogpoet
  • Medium 4.3
    CVE-2024-44006

    WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency woocommerce-multilingual.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.6.

    OnTheGoSystems WooCommerce Multilingual & Multicurrency Web / CMS
  • Medium 5.3
    CVE-2024-44019

    WordPress Contact Form 7 Campaign Monitor Extension plugin <= 0.4.67 - Arbitrary File Deletion vulnerability

    Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension contact-form-7-campaign-monitor-extension.This issue affects Contact Form 7 Campaign Monitor Extension: from n/a through <= 0.4.67.

    Renzo Johnson Contact Form 7 Campaign Monitor Extension
  • Medium 4.3
    CVE-2024-44020

    WordPress WP Free SSL plugin <= 1.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through <= 1.2.7.

    Prasad Kirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS Web / CMS
  • Medium 4.3
    CVE-2024-44031

    WordPress JoomSport plugin <= 5.6.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in beardev JoomSport joomsport-sports-league-results-management.This issue affects JoomSport: from n/a through <= 5.6.3.

    Beardev JoomSport
  • Medium 5.4
    CVE-2024-44021

    WordPress Truepush plugin <= 1.0.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in truepushplugin Truepush truepush-free-web-push-notifications.This issue affects Truepush: from n/a through <= 1.0.8.

    truepushplugin Truepush
  • Medium 4.3
    CVE-2024-44052

    WordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.10.

    HelloAsso HelloAsso
  • Medium 6.5
    CVE-2024-47308 Scanner template

    WordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Templately templately.This issue affects Templately: from n/a through <= 3.1.2.

    WPDeveloper Templately
  • Medium 4.3
    CVE-2024-47317

    WordPress Ads by WPQuads plugin <= 2.0.84 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded.This issue affects Ads by WPQuads: from n/a through <= 2.0.84.

    Ads by WPQuads Ads by WPQuads
  • Medium 4.3
    CVE-2024-47318

    WordPress PWA for WP & AMP plugin <= 1.7.72 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Magazine3 PWA for WP & AMP pwa-for-wp.This issue affects PWA for WP & AMP: from n/a through <= 1.7.72.

    Magazine3 PWA for WP & AMP
  • Medium 5.3
    CVE-2024-47358

    WordPress Popup Maker plugin <= 1.19.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Daniel Iser Popup Maker popup-maker.This issue affects Popup Maker: from n/a through <= 1.19.2.

    Daniel Iser Popup Maker
  • Medium 6.5
    CVE-2024-47321

    WordPress WP Datepicker plugin <= 2.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fahad Mahmood WP Datepicker wp-datepicker.This issue affects WP Datepicker: from n/a through <= 2.1.1.

    Fahad Mahmood WP Datepicker
  • Medium 6.5
    CVE-2024-47361

    WordPress Elementor Addon Elements plugin <= 1.13.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.6.

    WPVibes Elementor Addon Elements
  • Medium 4.3
    CVE-2024-47362

    WordPress Strong Testimonials plugin <= 3.1.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16.

    WP Chill Strong Testimonials
  • Medium 4.3
    CVE-2024-10399

    Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure

    The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, …

    WP Chill Download Monitor Web / CMS
  • Medium 5.3
    CVE-2024-50421

    WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 3.8.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing S…

    WP Overnight woocommerce-pdf-invoices-packing-slips Web / CMS