Unauthorized Data Modification in Media Manager for UserPro Plugin

CVE-2024-12821

What is CVE-2024-12821?

The Media Manager for UserPro plugin for WordPress has a vulnerability that permits unauthorized data modification due to a missing capability check in the upm_upload_media() function. This flaw affects all versions up to and including 3.12.0, allowing authenticated attackers with Subscriber-level access and above to alter arbitrary options on the WordPress site. An attacker could exploit this vulnerability to change the default registration role to administrator, enabling user registration and potentially granting themselves administrative privileges on the compromised site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References