CVE-2024-3607

The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() function in all versions up to, and including, 2.0.12. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts

Score

CVSS 3.1 4.3 Medium

Status

Modified - security@wordfence.com

Published

2024-05-02

Last modified

2026-04-08

Weaknesses

CWE-862

Affected products

• Property Hive (Propertyhive)
• Propertyhive (Wp-property-hive)

References

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3075163%40propertyhive&new=3075163%40p…
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d52ced-807b-48c0-bb7a-e40d143ae5d3?source=cve