CVE-2024-6624

Katalog CVE

CVSS 9.8 · Critical EPSS 2,9%

Kerentanan Improper Privilege Management pada parorrey json api user. Skor CVSS 3.1 9.8 (Critical) menurut wordfence.com.

Deskripsi (NVD)

The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin requires the JSON API plugin to also be installed.

Rincian

Terbit di NVD

11 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/3115185/ patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a26f60-5912-4d4a-8ef8-e4357c1fb1ff?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L187 product
• https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L51 product