CVE-2024-1385 is a high severity (CVSS 7.1) missing authorization flaw in the WP-Stateless Google Cloud Storage plugin for WordPress. In versions up to and including 3.4.0, any authenticated user, even a subscriber, can set arbitrary option values to the current time, which may take a site offline. Update to a release newer than 3.4.0.
What's affected
The record says all versions of the WP-Stateless plugin up to and including 3.4.0 are affected. The vulnerable code is the dismiss_notices function.
The record's references include a plugin changeset and a Wordfence entry, and they point to the plugin's own code change as the fix. The record does not name a fixed version number. Check the plugin's changelog on WordPress.org for the first release after 3.4.0 and treat that as your target.
Attackers need an account. Many sites allow open registration at subscriber level, so "authenticated" can be a low bar in practice.
How to check if you're exposed
List the plugin and its version with WP-CLI:
wp plugin list --name=wp-stateless --fields=name,status,version
If you do not use WP-CLI, open Plugins in the WordPress admin and read the version under the plugin name. Any version at or below 3.4.0 is affected.
Also check whether your site allows public registration under Settings, General, because that decides who can reach the function.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Confirm the installed WP-Stateless version.
- Update the plugin to the first release after 3.4.0 listed in its changelog.
- If you cannot update today, turn off open registration or deactivate the plugin until you can.
- Review recently registered subscriber accounts for ones you do not recognise.
- Check the options table for unexpected changes if the site has gone offline without explanation.
Why it matters
The weakness is CWE-862, missing authorization. The function that dismisses admin notices did not check what the caller was allowed to do, so any logged-in user could call it and supply the option name to change.
Setting a value to the current time sounds harmless, but WordPress stores critical settings as options. Overwriting the wrong one can break the site, and that is the availability impact the record describes. The score is moderate because there is no data theft here, only integrity and availability loss. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an administrator account?
No. The record says subscriber-level access and above is enough.
Is there a CWE for this class of bug?
Yes, CWE-862, missing authorization. It is one of the most common causes of WordPress plugin advisories.
Sources
- Wordfence vulnerability entry (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1385
Last reviewed: 19 October 2026.
