WordPress Eewee Admin Custom plugin <= 1.8.2.4 - CSRF to Privilege Escalation vulnerability
CVE-2024-54248

8.8HIGH

Key Information:

Vendor
WordPress
Status
Eewee Admin Custom
Vendor
CVE Published:
13 December 2024

Summary

The eewee Admin Custom plugin, developed by Michael DUMONTET, is affected by a Cross-Site Request Forgery (CSRF) vulnerability that may allow attackers to exploit the system and escalate their privileges. This vulnerability impacts versions from n/a up to 1.8.2.4, posing a significant security risk to users who have not updated their installations. Organizations utilizing this plugin should take immediate action to ensure they are not susceptible to attacks that exploit this weakness.

Affected Version(s)

eewee admin custom <= 1.8.2.4

References

https://patchstack.com/database/wordpress/plugin/eewee-ad...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.