Medium severity6.4NVD Advisory· Published Jul 27, 2024· Updated Jun 17, 2026

CVE-2024-6458

Description

The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers with subscriber access and above to change titles of arbitrary posts. Missing sanitization can lead to Stored Cross-Site Scripting when viewed by an admin via the WooCommerce Product Table.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Woocommerce Product Table Litellm-fuzzy
Range: <=3.5.1
Wcproducttable/Woocommerce Product Table Litecpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/e06fb465-4c72-49a8-af35-ff6d629ff9a0nvdThird Party Advisory
plugins.trac.wordpress.org/browser/wc-product-table-lite/trunk/presets/presets.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000