Unauthorized Data Modification Vulnerability in Apus Framework Plugin for WordPress

CVE-2024-12296

What is CVE-2024-12296?

The Apus Framework plugin for WordPress has a vulnerability that enables unauthorized modification of data, specifically through the 'import_page_options' function. This flaw arises from a missing capability check, affecting all versions up to 2.3. Authenticated attackers with Subscriber-level access and above can exploit this vulnerability to alter arbitrary options within the WordPress site. A notable risk includes the ability to change the default user registration role to administrator, potentially allowing attackers to gain administrative access to the site. Ensuring that this plugin is updated and securing user roles can dramatically mitigate the risks associated with this vulnerability.

References