CVE-2024-2292 HIGH

CVE-2024-2292: Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Data

Vendor Changeweb
Product changeweb/unifiedtransform
Weakness CWE-862 · Missing authorization
Published March 20, 2025
Last update October 15, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
October 15, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-10694 User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure CVE-2025-13812 GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure CVE-2023-48776 WordPress canvasio3D Light plugin <= 2.5.0 - Broken Access Control vulnerability CVE-2021-32504 CVE-2025-67993 WordPress Atarim plugin <= 4.2.1 - Broken Access Control vulnerability