CVE-2024-31366 HIGH

CVE-2024-31366: WordPress Post Type Builder (PTB) plugin <= 2.0.8 - Auth. Arbitrary Post/Page Creation vulnerability

Vendor Themify
Product Post Type Builder (PTB)
Weakness CWE-862 · Missing authorization
Published April 9, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in Themify Post Type Builder (PTB).This issue affects Post Type Builder (PTB): from n/a through 2.0.8.

Key dates

02Disclosure timeline

April 9, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-57987 WordPress WP Events Manager Plugin <= 2.2.1 - Broken Access Control Vulnerability CVE-2026-42071 MantisBT: Private Bugnote Attachment Content Leak via REST API CVE-2025-62915 WordPress SMS Contact Form 7 Notifications by ClickSend plugin <= 1.4.0 - Broken Access Control vulnerability CVE-2023-30479 WordPress Stamped.io Product Reviews & UGC for WooCommerce plugin <= 2.3.2 - Broken Access Control vulnerability CVE-2023-2561 Gallery Metabox <= 1.5 - Missing Authorization via gallery_remove