Unauthenticated Attacker Can Privilege Escalate via Account Takeover

CVE-2024-11103

Summary

The Contest Gallery plugin for WordPress contains a vulnerability that allows an attacker to escalate privileges through unauthorized access to user accounts. This is primarily caused by the plugin's failure to adequately validate a user's identity when processing password updates. As a result, unauthenticated attackers can exploit this flaw to reset passwords for any user, including administrative accounts, thus gaining access to sensitive functionalities and data within the WordPress environment. Users of versions 24.0.7 and earlier are strongly advised to update to the latest version to mitigate this risk.

References