Unauthorized Data Modification in Demo Awesome Plugin for WordPress

CVE-2024-13637

What is CVE-2024-13637?

The Demo Awesome plugin for WordPress presents a vulnerability that enables authenticated users, with at least Subscriber-level access, to bypass security checks on the install_plugin function. This flaw allows attackers to install and activate arbitrary plugins, which could lead to unauthorized modifications and potential exploitation of the WordPress site. This issue affects all versions of the plugin up to and including version 1.0.3, highlighting the importance of securing plugin installations.

References