Unauthenticated Attackers Can Access and Update User Accounts

CVE-2024-8791

What is CVE-2024-8791?

A vulnerability exists in the Charitable – Donations Plugin & Fundraising Platform for WordPress that allows for privilege escalation across all versions up to and including 1.8.1.14. This security flaw stems from the plugin's inadequate verification of a user's identity when the ID parameter is provided through the update_core_user() function. As a result, attackers lacking authentication can manipulate user accounts, potentially changing email addresses and passwords for any user, including those with administrator privileges. This exposure can lead to significant unauthorized access and control over user accounts, emphasizing the need for prompt remediation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References