WP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_new_datepicker_ajax() function in all versions up to, and including, 2.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options that can be used for privilege escalation. This was partially patched in 2.0.9 and 2.1.0, and fully patched in 2.1.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fahadmahmood | WP Datepicker | up to 2.1.0 | — | No fix listed | CNA |
- WP Datepicker Vendorfahadmahmood Affected up to 2.1.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:androidbubbles:wp_datepicker:*:*:*:*:*:wordpress:*:* | before 2.1.1 | Vulnerable | Androidbubbles |
- cpe:2.3:a:androidbubbles:wp_datepicker:*:*:*:*:*:wordpress:*:* Versions before 2.1.1 Vulnerable ·Androidbubbles
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3895
- 2026-10-03 Alias added: GHSA-6r8w-jhg7-gpr9
References
Patch 3
- https://plugins.trac.wordpress.org/changeset/3073525/wp-datepicker/trunk/inc/functions_inner.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3073221%40wp-datepicker&new=3073221%40wp-datepicker&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071975%40wp-datepicker&new=3071975%40wp-datepicker&sfp_email=&sfph_mail=
More fahadmahmood vulnerabilities
- TI-2025-07361 Injection Guard < 1.2.8 - Reflected XSS via $_SERVER['REQUEST_URI'] CVSS 3.1MEDIUM 6.1
- TI-2025-07132 WP Shopify < 1.5.4 - Reflected XSS CVSS 3.1MEDIUM 6.1
- TI-2024-09127 RSS Feed Widget < 3.0.1 - Reflected XSS CVSS 3.1MEDIUM 4.8
- TI-2025-11633 Easy Upload Files During Checkout <= 2.9.8 - Unauthenticated Arbitrary JavaScript File Upload CVSS 3.1CRITICAL 9.8
- TI-2026-02908 Injection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Name CVSS 3.1HIGH 7.2
- TI-2024-23564 WordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
Sources
- CVE-2024-3895 · CVE Program
- CVE-2024-3895 · NVD
- FIRST EPSS
- GHSA-6r8w-jhg7-gpr9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences