Unauthorized Modification of Data in Login/Signup Popup Plugin
CVE-2024-5324
Key Information:
What is CVE-2024-5324?
The Login/Signup Popup (Inline Form + Woocommerce) plugin for WordPress contains a vulnerability that allows authenticated attackers, including those with Subscriber-level access, to modify site options due to the absence of a capability check on the 'import_settings' function. This oversight affects versions 2.7.1 and 2.7.2, enabling attackers to not only alter various settings but also to enable new user registrations with default roles set to Administrator. Such an exploit poses significant risks for sites utilizing these vulnerable versions, highlighting the importance of timely updates and robust access controls.
Affected Version(s)
Login & Register Customizer – Popup | Slider | Inline | WooCommerce 2.7.1 <= 2.7.2
OTP Login & Register Woocommerce 0 <= 2.6.1
Side Cart Woocommerce | Woocommerce Cart 2.5