CVE detail

CVE-2024-10717 — CVE-2024-10717

Published 2024-11-13 · Modified 2026-06-17 · Vendor wpmonks · Product styler_for_ninja_forms · Source nvd
MEDIUM
severity
CVSS-derived band
6.5
CVSS v3
0–10 scale
0.0040
EPSS probability
exploitation probability, 30d
33.0%
EPSS percentile
percentile vs all CVEs
NOT LISTED
CISA KEV
known exploited catalog

Description

The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the deactivate_license function in all versions up to, and including, 3.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users. Note: This issue can also be used to add arbitrary options with an empty value.

Remediation

No vendor-published fix data in our corpus for this CVE. Check the references below or the vendor's PSIRT / security advisories page.

References

cvedb.io · NVD · CISA KEV · FIRST EPSS · vendor advisories (CVE Program List v5). Informational only, no warranty — verify every remediation against the vendor advisory before acting on it. This product uses data from the NVD API but is not endorsed or certified by the NVD, CISA, FIRST.org or any vendor named. CVE® is a registered trademark of The MITRE Corporation.