CVE-2021-24289 Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation

2021-05-1716:48:52

CWE-269

WPScan

www.cve.org

cve-2021-24289

store locator plus

wordpress plugin

authenticated

privilege escalation

user meta data

administrator

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

46.9%

JSON

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.

CNA Affected

[
  {
    "product": "Store Locator Plus for WordPress",
    "vendor": "Store Locator Plus",
    "versions": [
      {
        "lessThanOrEqual": "5.5.14",
        "status": "affected",
        "version": "5.5.14",
        "versionType": "custom"
      }
    ]
  }
]