Potential Privilege Escalation Vulnerability in The Post Form Plugin

CVE-2024-8246

Summary

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is prone to a vulnerability allowing privilege escalation due to insufficient access restrictions on user roles during registration. Authenticated attackers with contributor-level access or higher can exploit this weakness by creating a custom registration form that designates them as administrators, thereby gaining higher-level permissions within the WordPress site.

References