CVE-2024-12821

The CVE-2024-12821 entry concerns the WordPress plugin Media Manager for UserPro. A missing capability check in upm_upload_media() affects all versions up to 3.12.0, allowing authenticated users with Subscriber+ privileges to modify arbitrary options and potentially set the default registration r...

CVE-2024-12822

The CVE-2024-12822 entry affects the WordPress plugin Media Manager for UserPro. A missing capability check in add_capto_img() enables unauthorized modification of data, allowing unauthenticated attackers to update arbitrary WordPress options and potentially raise the default registration role to...