Unauthorized Data Modification in Media Manager for UserPro Plugin

CVE-2024-12821

Summary

The Media Manager for UserPro plugin for WordPress has a vulnerability that permits unauthorized data modification due to a missing capability check in the upm_upload_media() function. This flaw affects all versions up to and including 3.12.0, allowing authenticated attackers with Subscriber-level access and above to alter arbitrary options on the WordPress site. An attacker could exploit this vulnerability to change the default registration role to administrator, enabling user registration and potentially granting themselves administrative privileges on the compromised site.

References