Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-7258 is a high-severity Missing Authorization (CWE-862) vulnerability in Wpmarketingrobot Woocommerce Google Feed Manager. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 45% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The WooCommerce Google Feed Manager plugin for WordPress is affected by CVE-2024-7258, an authorization vulnerability (CWE-862) present in all versions through 2.8.0. The root cause is a missing capability check on the wppfm_removeFeedFile function, which permits authenticated users to invoke file-deletion operations without verifying sufficient privileges. The flaw carries a CVSS 3.1 score of 8.8.
Authenticated attackers holding Contributor or higher roles can invoke the unprotected AJAX handler to delete arbitrary files on the underlying server. Successful deletion of critical files such as wp-config.php can disable the site and enable remote code execution, turning the issue into a full compromise vector reachable over the network without user interaction.
Public references point to a patched changeset (3137475) in the plugin repository and a detailed advisory from Wordfence that identifies the affected JavaScript handlers. Site administrators are therefore advised to update the plugin to the newest release that enforces proper capability checks before allowing feed-file removal.
EPSS remains flat at 0.1050 with no material post-disclosure increase observed.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48205
Vulnerability Data
The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedFile' function in all versions up to, and including, 2.8.0. This makes it possible for authenticated attackers,…
more
with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of authorization decisions on every access request, structurally eliminating missing authorization checks.
AC-24 mandates that access control decisions are applied to each request, preventing bypass of authorization logic.
AC-25 requires a tamperproof, always-invoked reference monitor that ensures authorization checks cannot be omitted.
AC-6 reduces the set of actions reachable without proper authorization, limiting blast radius of missing checks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.18's provisioning, review, revocation and activation steps (incl. owner approval, SoD, timely removal on role/termination change) directly stop exploitation of missing authorization checks by ensuring no actor receives or retains rights to resources they should not access; the bounded remainder is that it cannot stop missing-authorization defects inside the enforcement mechanism itself once rights have been granted (e.g. flawed code that ignores the rights table).
A.8.3 directly mandates restricting access to information per policies via configuration, identity/group controls, isolation, and dynamic techniques that enforce authorization decisions, which squarely stops exploitation of missing authorization (CWE-862); the bounded remainder is non-access mechanisms such as path traversal or CSRF that are outside its scope per the AC-3/A01:2025 anchor.
Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.
By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.
Requiring evidence of minimum security capabilities and acceptance testing ensures that missing or bypassed authorization checks are detected before the delivered software is accepted.
Mandating read-only access or proxy execution by an authorized administrator ensures every requested operation is explicitly authorized before it occurs.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-862, a class-level weakness, and none of its children carries one either.