Vulnerability in WordPress Offload Media Plugin Allows Arbitrary Option Updates, Privilege Escalation

CVE-2024-10589

Summary

The Leopard - WordPress Offload Media plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level access and above to modify arbitrary data. This occurs due to a missing capability check within the import_settings() function across all versions up to and including 3.1.1. Exploitation of this vulnerability enables attackers to change critical site settings, such as updating the default role for new registrations to administrator, which could allow them to gain unauthorized administrative access to the WordPress site.

References