Privilege Escalation Vulnerability in WordPress Newsletters Plugin

CVE-2024-8247

What is CVE-2024-8247?

The Newsletters plugin for WordPress has a vulnerability allowing authenticated attackers with subscriber-level access and above to elevate their privileges to that of an administrator. This arises from the plugin's failure to adequately restrict updates to user meta as screen options. The exploit requires that lower-privileged users be granted access to edit the Sent & Draft Emails page of the plugin by an administrator, which opens the door for privilege escalation attacks. Websites utilizing this plugin should consider security measures to mitigate risks associated with unauthorized access and privilege escalation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References