CVE-2024-9518
CVSS V2 None
CVSS V3 None
Description
The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to insufficient restriction on the 'form_actions' and 'userplus_update_user_profile' functions. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.
Overview
- CVE ID
- CVE-2024-9518
- Assigner
- Wordfence
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-10-10T02:06:05.859Z
- Last Modified Date
- 2024-10-10T02:06:05.859Z
Weakness Enumerations
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-9518 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9518 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2024-10-10 13:41:14 | Added to TrackCVE |