CVE-2024-43118 MEDIUM

CVE-2024-43118: WordPress Hummingbird plugin <= 3.9.1 - Broken Access Control vulnerability

Vendor Wpmu Dev - Your All-In-One Wordpress Platform
Product Hummingbird
Weakness CWE-862 · Missing authorization
Published November 1, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.9.1.

Explanation of Vulnerability in Simple Terms

02Summary

The Hummingbird WordPress plugin through version 3.9.1 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can trigger actions that should be restricted to higher-privilege roles, resulting in a denial-of-service condition. The vulnerability requires valid WordPress credentials but no special interaction from other users.

What an attacker can do

03Attacker Capabilities

A low-privilege logged-in user can disrupt site availability by triggering restricted administrative functions.

Potential impact on your site

04Site Impact

Site availability may be degraded if a low-privilege user account is compromised or misused to trigger denial-of-service actions.

Conditions required to exploit

05Prerequisites

Attacker must have a valid WordPress user account with low privileges (e.g., Subscriber or Contributor role).

Key dates

06Disclosure timeline

November 1, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-11912 Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action CVE-2026-12119 Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute CVE-2026-57339 WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability CVE-2026-12113 Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure CVE-2026-57730 WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability