Unauthorized Data Modification Vulnerability in SV100 Companion Plugin for WordPress

CVE-2024-12155

Summary

The SV100 Companion plugin for WordPress presents a vulnerability that allows unauthenticated attackers to manipulate site configurations. This is due to a lack of capability checks in the settings_import() function, present in all versions up to and including 2.0.02. As a result, attackers can change various default options, including elevating the registration role to administrator, thereby granting themselves extensive control over the WordPress site. This vulnerability represents a significant security risk, enabling unauthorized user registration and potentially disastrous outcomes for the affected site.

References