Vulnerability in WordPress Offload Media Plugin Allows Arbitrary Option Updates, Privilege Escalation

CVE-2024-10589

What is CVE-2024-10589?

The Leopard - WordPress Offload Media plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level access and above to modify arbitrary data. This occurs due to a missing capability check within the import_settings() function across all versions up to and including 3.1.1. Exploitation of this vulnerability enables attackers to change critical site settings, such as updating the default role for new registrations to administrator, which could allow them to gain unauthorized administrative access to the WordPress site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References