Privilege Escalation Vulnerability in WordPress Newsletters Plugin

CVE-2024-8247

Summary

The Newsletters plugin for WordPress has a vulnerability allowing authenticated attackers with subscriber-level access and above to elevate their privileges to that of an administrator. This arises from the plugin's failure to adequately restrict updates to user meta as screen options. The exploit requires that lower-privileged users be granted access to edit the Sent & Draft Emails page of the plugin by an administrator, which opens the door for privilege escalation attacks. Websites utilizing this plugin should consider security measures to mitigate risks associated with unauthorized access and privilege escalation.

References