Privilege Escalation Vulnerability Affects WordPress Users

CVE-2024-8253

Summary

The Post Grid and Gutenberg Blocks plugin for WordPress presents a vulnerability that allows for privilege escalation due to insufficient restrictions on user meta value updates. This issue affects all versions from 2.2.87 to 2.2.90, enabling authenticated users with subscriber-level access and higher to manipulate their user meta settings to elevate their privileges to that of an administrator. The vulnerability arises from a failure to properly validate what user meta can be altered and whether the associated form is active, leading to a significant security risk for affected WordPress installations.

References