Privilege Escalation Vulnerability in WordPress Video Robot's Ultimate Video Importer Plugin

CVE-2024-9192

Summary

The WordPress Video Robot plugin, developed by CodeCanyon, is affected by a vulnerability that involves insufficient validation of user metadata, specifically in the wpvr_rate_request_result() function. This weakness enables authenticated users with subscriber-level access and above to manipulate their user metadata, allowing them to escalate their privileges to that of an administrator. This vulnerability impacts all versions of the plugin up to and including version 1.20.0, thereby posing a significant risk to WordPress sites utilizing this plugin.

References