Unauthorized Modification of Data Leads to Privilege Escalation Vulnerability in Classified Listing Plugin

CVE-2024-11194

What is CVE-2024-11194?

The Classified Listing – Classified ads & Business Directory Plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access and higher to alter data due to a misconfigured check on the 'rtcl_import_settings' function. This vulnerability enables these users to perform unauthorized updates to certain options within WordPress, which could result in granting themselves Administrator-level capabilities. The exploit requires that the targeted option have a value structured as an array, making this vulnerability a specific but critical concern for site administrators relying on these plugin versions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References