CVE-2024-32081 MEDIUM

CVE-2024-32081: WordPress Filter Custom Fields & Taxonomies Light plugin <= 1.05 - Broken Access Control vulnerability

Vendor Websupporter
Product Filter Custom Fields & Taxonomies Light
Weakness CWE-862 · Missing authorization
Published June 9, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in Websupporter Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.

Explanation of Vulnerability in Simple Terms

02Summary

Filter Custom Fields & Taxonomies Light through version 1.05 fails to properly check user permissions before allowing modifications to custom fields and taxonomies. A logged-in user with low privileges can alter settings they should not have access to. The vulnerability does not expose sensitive data or crash the site, but allows unauthorized changes to site configuration.

What an attacker can do

03Attacker Capabilities

Modify custom fields and taxonomy settings without proper authorization.

Potential impact on your site

04Site Impact

Unauthorized users can alter custom field and taxonomy configurations, potentially disrupting site structure or content organization.

Conditions required to exploit

05Prerequisites

Attacker must be logged in with a low-privilege account (e.g., subscriber or contributor).

Key dates

06Disclosure timeline

June 9, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65476 WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability CVE-2026-65500 WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability CVE-2026-15827 GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints CVE-2026-27423 WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability CVE-2026-65530 WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability