CVE-2024-13529: SocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Download
Description
The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'socialv_send_download_file' function in all versions up to, and including, 2.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download arbitrary files from the target system.
Classification
CVE ID: CVE-2024-13529
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.5
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
Vendor: iqonicdesign
Product: SocialV - Social Network and Community BuddyPress Theme
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.06% (probability of being exploited)
EPSS Percentile: 27.43% (scored less or equal to compared to others)
EPSS Date: 2025-03-05 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0b766a-b7fd-4950-9868-de3308123229?source=cvehttps://assets.iqonic.design/documentation/wordpress/socialv-doc/index.html#changelog
https://themeforest.net/item/socialv-community-buddypress-theme/38612588