Unauthorized Modification of Data Leads to Privilege Escalation Vulnerability in Classified Listing Plugin

CVE-2024-11194

Summary

The Classified Listing – Classified ads & Business Directory Plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access and higher to alter data due to a misconfigured check on the 'rtcl_import_settings' function. This vulnerability enables these users to perform unauthorized updates to certain options within WordPress, which could result in granting themselves Administrator-level capabilities. The exploit requires that the targeted option have a value structured as an array, making this vulnerability a specific but critical concern for site administrators relying on these plugin versions.

References