CVE-2024-7894 MEDIUM

CVE-2024-7894: If Menu <= 0.19.1 - Missing Authorization to License Key Update

Vendor Andreiigna
Product If Menu – Visibility control for Menus
Weakness CWE-862 · Missing authorization
Published December 7, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The If Menu plugin for WordPress is vulnerable to unauthorized modification of the plugin's license key due to a missing capability check on the 'actions' function in versions up to, and including, 0.19.1. This makes it possible for unauthenticated attackers to modify delete or modify the license key.

Key dates

02Disclosure timeline

December 7, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-33555 WordPress XStore Core plugin <= 5.3.8 - Multiple Authenticated Broken Access Control vulnerability CVE-2023-48286 WordPress Accept Stripe Payments plugin <= 2.0.79 - Broken Access Control vulnerability CVE-2026-48119 Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services CVE-2023-51650 Unauthorized access vulnerability on three interfaces CVE-2024-13312 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076