CVE-2024-52500
Published: 14 February 2025
Summary
CVE-2024-52500 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-52500 is a missing authorization vulnerability (CWE-862) in the Monetag Official WordPress plugin (monetag-official), affecting all versions through 1.1.3. The flaw allows exploitation of incorrectly configured access control security levels, enabling unauthorized actions within the plugin's functionality.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required (AV:N/AC:L/PR:N/UI:N). Successful exploitation leads to low-impact violations of integrity and availability, with a changed scope (S:C), as reflected in the CVSS v3.1 base score of 7.2 (C:N/I:L/A:L).
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/monetag-official/vulnerability/wordpress-monetag-official-plugin-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4904
Vulnerability details
Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in public-facing WordPress plugin enables remote unauthenticated exploitation of application functionality.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access to system resources, directly mitigating the missing authorization checks in the Monetag plugin that allow unauthenticated exploitation.
Explicitly identifies and authorizes specific actions permitted without identification or authentication, preventing unauthenticated attackers from performing unauthorized actions in the plugin.
Employs least privilege to restrict access to only necessary functions, limiting the impact of broken access controls in the plugin even if initial authorization fails.