Limited Privilege Escalation Vulnerability in Zephyr Project Manager for WordPress

CVE-2024-7624

What is CVE-2024-7624?

The Zephyr Project Manager plugin for WordPress is susceptible to a privilege escalation vulnerability across all versions up to and including 3.3.101. This flaw arises from the plugin's failure to validate user capabilities correctly within the update_user_access() function. As a result, authenticated users with subscriber-level access or higher can manipulate their permissions, enabling unrestricted access to the plugin's settings. This could allow them to alter configurations and potentially compromise the integrity of the WordPress installation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References