Privilege Escalation in Malware Scanner and Web Application Firewall for WordPress by MiniOrange

CVE-2024-2172

Summary

The Malware Scanner and the Web Application Firewall plugins for WordPress, developed by MiniOrange, exhibit a vulnerability that allows unauthenticated attackers to escalate their privileges due to a missing capability check in the mo_wpns_init() function. This flaw affects all versions of the Malware Scanner up to and including 4.7.2 and the Web Application Firewall up to and including 2.1.1. Attackers exploiting this vulnerability can gain administrative access, posing serious risks to website integrity and security.

References