CVE-2024-9518

CVE-2024-9518 affects the WordPress plugin UserPlus (versions up to 2.0). The issue is unauthenticated privilege escalation caused by insufficient restriction on the functions form_actions and userplus_update_user_profile, allowing an attacker to specify a higher user role via the role parameter ...