CVE-2024-10294 MEDIUM

CVE-2024-10294: CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change

Vendor Ce21Com

Product CE21 Suite

Weakness CWE-862 · Missing authorization

Published November 9, 2024

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single_sign_on_save_api_settings' function in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to change plugin settings.

Key dates

02Disclosure timeline

November 9, 2024 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-10294 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2023-49859 WordPress Login With Ajax plugin <= 4.1 - Broken Access Control vulnerability CVE-2025-58969 WordPress Custom Login URL Plugin <= 1.0.2 - Broken Access Control Vulnerability CVE-2024-5861 WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection CVE-2026-32434 WordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability CVE-2024-37111 WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Denial of Service Attack vulnerability