CVE-2024-1108 is a Medium severity missing authorization flaw, scored 6.5, in the Plugin Groups plugin for WordPress. Versions up to and including 2.0.6 are affected. Unauthenticated users can change plugin settings, which can cause a denial of service. Update to a later release.
What's affected
The record lists Plugin Groups up to and including 2.0.6. The admin_init() function lacks a capability check, so unauthenticated visitors can change the plugin's settings. The record says a misconfiguration can also cause denial of service.
No fixed version is named in the record. A changeset (3036754) is among the references, but the Wordfence page body could not be read when fetched. Check the changelog for the first release after 2.0.6.
How to check if you're exposed
In the WordPress admin, open Plugins, Installed Plugins and read the version shown under Plugin Groups. From a shell with WP-CLI, list plugins and their versions.
wp plugin list --fields=name,status,version,update
Compare the version with the affected range above. If the plugin is not installed, you are not exposed through this CVE. The free in-browser dependency scan also covers dependencies in your own code, though WordPress plugins are tracked by the site, not a lockfile.
What to do now
- Check the installed Plugin Groups version.
- Update to a release after 2.0.6, confirming the changelog mentions the fix.
- Review the plugin's settings against what you configured, since an outsider could have changed them.
- Check that plugin groups did not disable plugins your site needs, such as security or caching plugins.
- If the plugin is unused, remove it.
Why it matters
The class is missing authorization, CWE-862. Hooking a settings change onto admin_init is a known trap in WordPress, because that hook fires for requests that are not from signed in administrators. Settings changes must check the user's capability on every path.
The damage is mostly availability and misconfiguration. A site where protective plugins were silently turned off is the worry. The record's KEV flag is false.
Quick check
Can an attacker break my site with this?
The record says a misconfiguration caused by changing settings can cause denial of service.
What is the fixed version?
The record names none beyond 'up to 2.0.6'. Use the first newer release and confirm in the changelog.
Sources
- Wordfence advisory and plugin changeset, from the record references (Wordfence advisory, page body could not be read when fetched)
- NVD record and references for CVE-2024-1108
Last reviewed: 19 October 2026.
