CVE-2024-9215

🗓️ 17 Oct 2024 02:06:04Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 90 Views🌐 WEB

Insecure Direct Object Reference & Privilege Escalation in PublishPress Authors plugin for WordPres

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-9215	17 Oct 202404:56	–	circl
CNNVD	WordPress plugin PublishPress Authors has a security vulnerability	17 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-9215 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover	17 Oct 202402:06	–	cvelist
EUVD	EUVD-2024-49797	3 Oct 202520:07	–	euvd
NVD	CVE-2024-9215	17 Oct 202402:15	–	nvd
Patchstack	WordPress PublishPress Authors Plugin <= 4.7.1 is vulnerable to Privilege Escalation	16 Oct 202400:00	–	patchstack
Patchstack	WordPress PublishPress Authors plugin <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover vulnerability	16 Oct 202414:07	–	patchstack
Positive Technologies	PT-2024-39496 · WordPress · Publishpress Authors	16 Oct 202400:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-9215: Authorization Bypass Through User-Controlled Key	17 Oct 202400:00	–	rapid7
RedhatCVE	CVE-2024-9215	5 Feb 202504:33	–	redhatcve

Vulners

Vulnrichment

Node

publishpress co-authorsRange≤4.7.1wordpress

[
  {
    "vendor": "publishpress",
    "product": "Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.7.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/d0506137-82e3-4988-9b23-370465a866c0
plugins	www.plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.7.1/src/core/Classes/Author_Editor.php
plugins	www.plugins.trac.wordpress.org/changeset

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	The action_edited_author() function in the PublishPress Authors plugin fails to validate the 'authors-user_id' parameter, allowing authenticated users with Author-level access to update the email addresses of arbitrary user accounts, including administrators.	CWE-639
authors-user_id	request body	/wp-admin/admin-ajax.php	The action_edited_author() function in the PublishPress Authors plugin fails to validate the 'authors-user_id' parameter, allowing authenticated users with Author-level access to update the email addresses of arbitrary user accounts, including administrators.	CWE-639

17 Jun 2026 08:24Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.8

EPSS0.00512

SSVC

CWE-639