Authentication Bypass Vulnerability Affects WordPress Plugin

CVE-2024-10311

Summary

The External Database Based Actions plugin for WordPress contains a significant vulnerability that allows authenticated attackers, who possess subscriber-level permissions or higher, to bypass authentication checks. This flaw is rooted in a lack of necessary capability verification in the 'edba_admin_handle' function. As a result, potential attackers can alter plugin settings and gain unauthorized access to accounts of existing users, including administrators. This vulnerability poses a serious risk to WordPress sites utilizing this plugin, necessitating swift remedial action to secure affected systems.

References