Unauthorized Modification of Data Leads to Privilege Escalation in de:branding Plugin

CVE-2024-11443

Summary

The de:branding plugin for WordPress contains a vulnerability that allows authenticated users with subscriber-level access or higher to modify site options without proper authorization. This occurs due to a lack of capability checks in the debranding_save() function, present in all versions up to and including 1.0.2. Malicious actors can exploit this vulnerability to elevate their privileges by changing the default registration role to administrator. Consequently, attackers could enable user registration on a compromised site, granting themselves administrative access and potentially leading to further compromises.

References