Privilege Escalation Vulnerability in Custom Login Page Styler for WordPress
CVE-2024-12594

8.8HIGH

Key Information:

Vendor

WordPress
Status
Login Page Styler – Custom WordPress Login Page Customizer & Security
Vendor
CVE Published:
24 December 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-12594?

The Custom Login Page Styler – Login Protected Private Site plugin for WordPress contains a vulnerability that enables privilege escalation due to the lack of capability checks on the 'lps_generate_temp_access_url' AJAX action. This weakness affects all versions up to and including 7.1.1. As a result, authenticated attackers with Subscriber-level access or higher may exploit this flaw to gain unauthorized access to other users' accounts, including those of subscribers. It is crucial for WordPress site administrators to update their plugins to the latest version to mitigate possible exploits of this vulnerability.

Affected Version(s)

Login Page Styler – Custom WordPress Login Page Customizer & Security 0 <= 7.1.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-12594
Created by RandomRobbieBF

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
.