CWE-463
Weakness AllowedDeletion of Data Structure Sentinel
Abstraction: Base · Status: Incomplete
The accidental deletion of a data-structure sentinel can cause serious programming logic problems.
Often times data-structure sentinels are used to mark structure of the data structure. A common example of this is the null character at the end of strings. Another common example is linked lists which may contain a sentinel to mark the end of the list. It is dangerous to allow this type of control data to be easily accessible. Therefore, it is important to protect from the deletion or modification outside of some wrapper interface which provides safety.
Dimensions
- Behavior-Type: Deletion
- Code-Type: Data Structure Sentinel
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Relationships and members
Modes of introduction
Notes
Research Gap · CWE 5.0 · 2026-10-22
It is not clear whether CWE-463 or CWE-464 should be children of CWE-707, since these weaknesses seem likely to originate from other root causes (i.e., other CWE entries) and are not "neutralization" at least in terms of inputs. More investigation is needed.
Research Gap · CWE 5.0 · 2026-10-22
Much of the focus of this entry is on NULL terminators (CWE-170), so this relationship should be explored and formalized. However, some sentinels (e.g., end of a linked list) are not related to use of NULL terminators.
Content history
updated Time_of_Introduction
updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
updated Potential_Mitigations
updated Description, Other_Notes
updated Common_Consequences, Demonstrative_Examples
updated References, Relationships
updated Potential_Mitigations
updated Relationships
updated Demonstrative_Examples
updated References, Relationships
updated Relationships, Time_of_Introduction
updated Mapping_Notes
updated Weakness_Ordinalities
updated Dimensions
4 vulnerabilities reference this CWE, most recent first.
CVE-2024-13318 (GCVE-0-2024-13318)
Vulnerability from cvelistv5 – Published: 2025-01-10 11:10 – Updated: 2026-04-08 16:58- CWE-463 - Deletion of Data Structure Sentinel
| Vendor | Product | Version | |
|---|---|---|---|
| smartdatasoft | Essential WP Real Estate |
Affected:
0 , ≤ 1.1.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13318",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-10T14:50:00.518872Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-10T14:50:09.317Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Essential WP Real Estate",
"vendor": "smartdatasoft",
"versions": [
{
"lessThanOrEqual": "1.1.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thanh Nam Tran"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-463",
"description": "CWE-463 Deletion of Data Structure Sentinel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:58:47.869Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1a9e22-d174-43fc-aab6-f6968067a290?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/essential-wp-real-estate/trunk/src/Common/Ajax/Ajax.php#L724"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-09T22:18:30.000Z",
"value": "Disclosed"
}
],
"title": "Essential WP Real Estate \u003c= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13318",
"datePublished": "2025-01-10T11:10:45.380Z",
"dateReserved": "2025-01-09T22:17:39.866Z",
"dateUpdated": "2026-04-08T16:58:47.869Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GHSA-4557-P767-895M
Vulnerability from github – Published: 2025-01-10 12:30 – Updated: 2025-01-10 12:30The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.
{
"affected": [],
"aliases": [
"CVE-2024-13318"
],
"database_specific": {
"cwe_ids": [
"CWE-463"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-10T12:15:24Z",
"severity": "MODERATE"
},
"details": "The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.",
"id": "GHSA-4557-p767-895m",
"modified": "2025-01-10T12:30:36Z",
"published": "2025-01-10T12:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13318"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/essential-wp-real-estate/trunk/src/Common/Ajax/Ajax.php#L724"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1a9e22-d174-43fc-aab6-f6968067a290?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7GR6-PQW7-P68C
Vulnerability from github – Published: 2024-05-15 00:30 – Updated: 2024-05-15 00:30There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point.
{
"affected": [],
"aliases": [
"CVE-2024-31475"
],
"database_specific": {
"cwe_ids": [
"CWE-463"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T23:15:10Z",
"severity": "HIGH"
},
"details": "There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba\u0027s access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point.\n\n",
"id": "GHSA-7gr6-pqw7-p68c",
"modified": "2024-05-15T00:30:37Z",
"published": "2024-05-15T00:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31475"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QPJW-29J5-FFFR
Vulnerability from github – Published: 2024-05-15 00:30 – Updated: 2024-05-15 00:30There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point
{
"affected": [],
"aliases": [
"CVE-2024-31474"
],
"database_specific": {
"cwe_ids": [
"CWE-463"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T23:15:10Z",
"severity": "HIGH"
},
"details": "There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba\u0027s Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point\n\n",
"id": "GHSA-qpjw-29j5-fffr",
"modified": "2024-05-15T00:30:37Z",
"published": "2024-05-15T00:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31474"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation MIT-10
Strategy: Compilation or Build Hardening
- Run or compile the software using features or extensions that automatically provide a protection mechanism that mitigates or eliminates buffer overflows.
- For example, certain compilers and extensions provide automatic buffer overflow detection mechanisms that are built into the compiled code. Examples include the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice.
Mitigation
Use OS-level preventative functionality. Not a complete solution.
No CAPEC attack patterns related to this CWE.