Privilege Escalation Vulnerability in WordPress User Extra Fields Plugin

CVE-2024-10800

Summary

The WordPress User Extra Fields plugin, developed by CodeCanyon, is susceptible to a privilege escalation flaw due to a lack of capability checks in the ajax_save_fields() function. This vulnerability affects all versions up to and including 16.6. Authenticated users with subscriber-level access and higher can exploit this vulnerability to add custom fields. Subsequently, they can utilize the check_and_overwrite_wp_or_woocommerce_fields function to modify the wp_capabilities field, effectively elevating their privileges to that of an administrator. This poses significant risks to website security, as it allows unauthorized access to critical functionalities and controls.

References