Critical Data Modification Vulnerability in Maintenance & Coming Soon Redirect Animation Plugin for WordPress

Summary

CVE-2024-9503 is a critical security vulnerability affecting the Maintenance & Coming Soon Redirect Animation plugin for WordPress. This issue arises from a lack of proper capability checks in the plugin's functions – specifically 'wploti_add_whitelisted_roles_option', 'wploti_remove_whitelisted_roles_option', 'wploti_add_whitelisted_users_option', 'wploti_remove_whitelisted_users_option', and 'wploti_uploaded_animation_save_option'. Authenticated users with Subscriber-level access and above can exploit this vulnerability to modify crucial plugin settings, potentially compromising the integrity and security of the website. All versions up to and including v2.1.3 are impacted, necessitating immediate action to mitigate risks.

Refferences