CVE-2024-3668

Katalog CVE

CVSS 8.8 · High EPSS 0,43%

Kerentanan Incorrect Permission Assignment for Critical Resource pada ideabox powerpack addons for elementor. Skor CVSS 3.1 8.8 (High) menurut wordfence.com.

Deskripsi (NVD)

The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with administrator set as the default role and then register as an administrator.

Rincian

Terbit di NVD

8 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wordfence.com/threat-intel/vulnerabilities/id/249ccc77-0daf-41bc-b5c5-991bf17d645d?source=cve advisory pihak ketiga
• https://powerpackelements.com/change-logs/ release notes