Unauthorized Modification of Data Leads to Privilege Escalation in de:branding Plugin

CVE-2024-11443

What is CVE-2024-11443?

The de:branding plugin for WordPress contains a vulnerability that allows authenticated users with subscriber-level access or higher to modify site options without proper authorization. This occurs due to a lack of capability checks in the debranding_save() function, present in all versions up to and including 1.0.2. Malicious actors can exploit this vulnerability to elevate their privileges by changing the default registration role to administrator. Consequently, attackers could enable user registration on a compromised site, granting themselves administrative access and potentially leading to further compromises.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References