Privilege Escalation Vulnerability in WHMPress Plugin by WHMCS

CVE-2024-9195

What is CVE-2024-9195?

The WHMPress - WHMCS Client Area plugin for WordPress is susceptible to unauthorized data modification due to a lack of necessary capability checks in the update_settings function within the /admin/ajax.php file. This vulnerability affects all versions up to and including 4.3-revision-3. Authenticated attackers with Subscriber-level access or higher can exploit this flaw to alter arbitrary options on the WordPress site, potentially elevating their privileges by changing the default role for new registrations to administrator. This could inadvertently allow attackers to gain administrative access to the vulnerable WordPress site, posing a significant security risk.

References