CVE-2024-1745: testimonial — Exploit

Description

The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them.

Is your site exposed to CVE-2024-1745?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected Products

Vendor	Product	Versions
radiustheme	testimonial_slider_and_showcase	< 2.3.7

References

Exploits

https://wpscan.com/vulnerability/b63bbfeb-d6f7-4c33-8824-b86d64d3f598/ https://wpscan.com/vulnerability/b63bbfeb-d6f7-4c33-8824-b86d64d3f598/

Frequently Asked Questions

What is CVE-2024-1745? +

The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them. It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2024-1745? +

CVE-2024-1745 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-1745? +

CVE-2024-1745 affects products from radiustheme, specifically: testimonial_slider_and_showcase. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-1745? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-7327 8.8

The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, …

CVE-2024-1315 8.8

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in …

CVE-2024-1352 6.5

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification …

CVE-2024-35739 6.5

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The …

CVE-2024-37520 6.5

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme ShopBuilder – Elementor …

CVE-2024-1427 6.4

The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to …

CVE-2024-1745