Privilege Escalation Vulnerability in FundEngine WordPress Plugin

CVE-2024-6698

Summary

The FundEngine plugin for WordPress is susceptible to a privilege escalation vulnerability due to inadequate verification of user metadata. This flaw affects all versions up to and including 1.7.0, allowing authenticated attackers possessing subscriber-level access or higher to manipulate their user meta. By exploiting this vulnerability, attackers can enhance their capabilities, potentially gaining unauthorized administrator-level access to the WordPress site. It is critical for users of the FundEngine plugin to ensure they implement immediate measures to mitigate the risks associated with this vulnerability.

References