CVE-2024-5570

The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.55% chance of exploitation in the next 30 days, 44th percentile

Published

2024-06-28

Updated

2025-08-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/49b3a8cb-f606-4cf7-80ec-bfdafd74e848/

References

• CVE Record
• NVD entry

Related

• CVE-2024-55661
• CVE-2024-5573
• CVE-2024-55656
• CVE-2024-5575
• CVE-2024-55653
• CVE-2024-5578