CVE-2024-47318 MEDIUM

CVE-2024-47318: WordPress PWA for WP & AMP plugin <= 1.7.72 - Broken Access Control vulnerability

Vendor Magazine3
Product PWA for WP & AMP
Weakness CWE-862 · Missing authorization
Published November 1, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in Magazine3 PWA for WP & AMP pwa-for-wp.This issue affects PWA for WP & AMP: from n/a through <= 1.7.72.

Explanation of Vulnerability in Simple Terms

02Summary

PWA for WP & AMP versions up to 1.7.72 lack proper authorization checks, allowing an attacker to modify site content if a user visits a malicious link. The vulnerability requires user interaction but does not require authentication. Site administrators should update to a version newer than 1.7.72 to prevent unauthorized modifications.

What an attacker can do

03Attacker Capabilities

Modify site content if a user clicks a malicious link.

Potential impact on your site

04Site Impact

Site content could be altered without authorization if users are tricked into clicking malicious links.

Conditions required to exploit

05Prerequisites

User must click an attacker-supplied link; no authentication required.

Key dates

06Disclosure timeline

November 1, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-12134 JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action CVE-2026-12119 Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute CVE-2026-57750 WordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerability CVE-2026-9230 Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure CVE-2026-11773 Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification