453 matches found
CVE-2024-7493 WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta
The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing arbitrary data to be passed to wpinsertuser during registration. This makes it possible for unauthenticated attackers to update their role ...
CVE-2024-8247
The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the plugin not restricting what user meta can be updated as screen options. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2024-8247
The CVE-2024-8247 entry concerns the Newsletters plugin for WordPress (
CVE-2024-8247 Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation
The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the plugin not restricting what user meta can be updated as screen options. This makes it possible for authenticated attackers, with subscriber-level access and...
WordPress WPCOM Member plugin <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta vulnerability
Unauthenticated Privilege Escalation via User Meta vulnerability discovered by wesley wcraft in WordPress Plugin WPCOM Member versions = 1.5.2.1...
CVE-2024-7291
The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as...
CVE-2024-7291
The CVE-2024-7291 entry concerns JetFormBuilder for WordPress. It describes an authenticated privilege-escalation flaw in versions up to and including 3.3.4.1 caused by improper restriction on user meta fields, enabling an administrator+ on multi-site installations to register as a super-admin. C...
CVE-2024-6698
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the updateusermeta function. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2024-6698
CVE-2024-6698: FundEngine – Donation and Crowdfunding Platform for WordPress is vulnerable to privilege escalation in all versions up to and including 1.7.0. The root cause is improper verification of user meta updates performed via update_user_meta, enabling authenticated users with subscriber-l...
CVE-2024-6698 FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the updateusermeta function. This makes it possible for authenticated attackers, with subscriber-level...
PT-2024-37805 · WordPress · Fundengine
Name of the Vulnerable Software and Affected Versions: FundEngine plugin for WordPress versions up to, and including, 1.7.0 Description: The issue is due to the plugin not properly verifying user meta updated through the update user meta function. This allows authenticated attackers, with...
CVE-2024-6624
The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin require...
PT-2024-37753 · WordPress · Json Api User +1
Name of the Vulnerable Software and Affected Versions: JSON API User plugin for WordPress versions up to, and including, 3.9.3 Description: The issue is due to improper controls on custom user meta fields, making it possible for unauthenticated attackers to register as administrators on the site...
WordPress plugin JSON API User security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
CVE-2024-5596
The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly implemented nonce validation function on multiple functions. This makes it possible for unauthenticated attackers to modify, or delete user meta...
Widget Options - Extended <= 5.1.0 & Widget Options <= 4.0.1 - Authenticated (Subscriber+) Information Disclosure
Description The Widget Options - Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 5.1.3 exclusive for Widget Options - Extended and all versions up to, and including, 4.0.1 for Widget Options. This makes it possible for unauthenticated attackers ...
WordPress Widget Options plugin <= 4.0.1 - Subscriber+ User Meta Data Exposure Vulnerability
Subscriber+ User Meta Data Exposure Vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Widget Options versions = 4.0.1...
CVE-2024-4222
CVE-2024-4222 affects the Tutor LMS Pro WordPress plugin. A missing capability check in multiple functions allows unauthenticated attackers to add, modify or delete user meta and plugin options across versions up to 2.7.0. The issue enables unauthorized data access/modification and data loss. Rem...
PT-2024-29795 · WordPress · Tutor Lms Pro
Name of the Vulnerable Software and Affected Versions: Tutor LMS Pro plugin for WordPress versions prior to 2.7.1 Description: The issue allows unauthorized access, modification, and loss of data due to a missing capability check on multiple functions. This enables unauthenticated attackers to ad...