What is the CVSS score of CVE-2024-54369?

CVE-2024-54369 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 19.3%.

Which versions of Zita Site Builder are affected by CVE-2024-54369?

Zita Site Builder plugin (WordPress, versions ≤1.0.2) contains a critical authorization bypass allowing remote attackers to circumvent access controls without authentication, risking unauthorized…

How to fix or mitigate CVE-2024-54369?

24 hours: Audit all WordPress installations for Zita Site Builder plugin presence and review authentication logs for suspicious activity. 7 days: Deactivate and remove the vulnerable plugin or implement network access restrictions via Web Application Firewall; evaluate alternative plugins for required functionality. 30 days: Establish monitoring for vendor security updates and implement a plugin assessment process to prevent similar exposures.

Zita Site Builder CVE-2024-54369

CRITICAL

Missing Authorization (CWE-862)

2024-12-16 audit@patchstack.com

Authentication Bypass

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.1 (CRITICAL)

CVE Published

Dec 16, 2024 - 15:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.

AnalysisAI

Missing authorization in ThemeHunk's Zita Site Builder WordPress plugin (versions through 1.0.2) allows remote unauthenticated attackers to invoke functionality that should be restricted by ACLs, leading to high integrity and availability impact. No public exploit identified at time of analysis, but the EPSS score of 19.29% (95th percentile) signals elevated likelihood of exploitation activity relative to most CVEs. The flaw is network-reachable with low attack complexity and no user interaction required, making it attractive for opportunistic mass-scanning against WordPress sites.

Technical ContextAI

Zita Site Builder (ai-site-builder) is a WordPress plugin from ThemeHunk that provides AI-assisted site building capabilities, typically exposing AJAX endpoints or REST routes to perform privileged site-modification actions. The root cause is CWE-862 (Missing Authorization), meaning one or more handlers fail to enforce capability or nonce checks (e.g., missing current_user_can() or permission_callback verification) before executing sensitive operations. This is a recurring pattern in the WordPress plugin ecosystem where developers rely on UI-level gating rather than server-side authorization, allowing direct HTTP calls to bypass intended ACLs.

Affected ProductsAI

ThemeHunk Zita Site Builder (also referenced as ai-site-builder) WordPress plugin, all versions from initial release through and including 1.0.2. The advisory was published via Patchstack (audit@patchstack.com), which is the canonical source for vendor coordination on this issue; no NVD CPE strings were supplied in the provided intelligence, so exact CPE matching should be verified against the Patchstack advisory before inventory scans.

RemediationAI

Patch availability is not explicitly confirmed in the provided data - the affected range terminates at 1.0.2 with no fixed version disclosed, so administrators should consult the Patchstack advisory (patchstack.com) and the ThemeHunk plugin page on wordpress.org for an updated release beyond 1.0.2 and apply it immediately once available. Until a vendor-released patch is confirmed, compensating controls include deactivating and removing the Zita Site Builder (ai-site-builder) plugin entirely (trade-off: loss of site-builder functionality), restricting access to /wp-admin/admin-ajax.php and the plugin's REST routes via a Web Application Firewall such as Patchstack, Wordfence, or ModSecurity with virtual-patching rules for this CVE (trade-off: WAF rule accuracy and false positives), and IP-allowlisting the WordPress admin surface at the web-server or CDN layer (trade-off: blocks legitimate distributed editors). Do not rely solely on .htaccess role checks since the vulnerability is in plugin-level handlers that execute before role gating.