Unauthenticated Attackers Can Escalate Privileges Through Registration Flaws

CVE-2024-9265

What is CVE-2024-9265?

The Echo RSS Feed Post Generator plugin for WordPress is exposed to privilege escalation due to insufficient role restrictions during user registration. Specifically, the echo_check_post_header_sent() function fails to properly limit the user roles that can be assigned, enabling unauthenticated attackers to register as administrators. This vulnerability poses a significant security risk, as it allows malicious users to gain full control over WordPress sites leveraging this plugin.

References