Medium severity5.4NVD Advisory· Published Mar 20, 2024· Updated Apr 8, 2026
CVE-2024-2538
CVE-2024-2538
Description
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:a:permalink_manager_lite_project:permalink_manager_lite:*:*:*:*:*:wordpress:*:*Range: <2.4.3.2
- Range: <=2.4.3.1
Patches
Vulnerability mechanics
References
3- plugins.trac.wordpress.org/changeset/3052848nvdPatch
- gist.github.com/Xib3rR4dAr/b1eec00e844932c6f2f30a63024b404envdExploitThird Party Advisory
- www.wordfence.com/threat-intel/vulnerabilities/id/70cd028d-122d-4e3c-ac09-150dec07a2cdnvdThird Party Advisory
News mentions
0No linked articles in our index yet.