Unauthenticated Privilege Escalation Vulnerability in JSON API User Plugin for WordPress
CVE-2024-6624
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 July 2024
Badges
What is CVE-2024-6624?
The JSON API User plugin for WordPress is susceptible to a privilege escalation vulnerability due to improper controls on custom user meta fields. This flaw exists in all versions up to and including 3.9.3, allowing unauthenticated attackers to exploit the vulnerability. By leveraging this weakness, attackers can register as administrators on vulnerable WordPress sites. It is pertinent to note that the exploitation is contingent on having the JSON API plugin also installed. Administrators of affected WordPress sites should prioritize patching this vulnerability to safeguard their environment.
Affected Version(s)
JSON API User 0 <= 3.9.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.