CVE-2024-6591: Nitesh Singh Ultimate WordPress Auction Plugin

Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.

Affected products

• Nitesh Singh Ultimate WordPress Auction Plugin: up to and including 4.2.7; up to and including 4.2.6

Published 2024-07-27. Last modified 2026-06-17.