Privilege Escalation in Homey Login Register Plugin for WordPress

CVE-2024-11951

What is CVE-2024-11951?

The Homey Login Register plugin for WordPress presents a vulnerability that permits unauthenticated users to exploit the account registration process. Specifically, the plugin allows new users to set their own user roles, including the ability to register as an administrator. This flaw can lead to unauthorized privilege escalation, enabling attackers to gain administrative access to the WordPress site and potentially compromising site security and data integrity.

References