CVE-2024-2538

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS

0.57% chance of exploitation in the next 30 days, 45th percentile

Published

2024-03-20

Updated

2026-04-08

Proof-of-concept exploits (1)

• https://gist.github.com/Xib3rR4dAr/b1eec00e844932c6f2f30a63024b404e

References

• CVE Record
• NVD entry

Related

• CVE-2024-25376
• CVE-2024-25381
• CVE-2024-25373
• CVE-2024-25385
• CVE-2024-25369
• CVE-2024-25398