PT-2025-9823 · WordPress · Homey Login Register

Tonn · Publicado 2025-03-05 · Atualizado 2025-03-06 · CVE-2024-11951

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Homey Login Register plugin for WordPress versions up to and including 2.4.0

Description The issue allows unauthenticated attackers to gain elevated privileges by exploiting a flaw in the plugin's account registration process. This is possible because the plugin permits users to set their own role during registration, including the administrator role.

Recommendations For versions up to and including 2.4.0, update to a version that contains a fix for this issue to prevent privilege escalation.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2024-11951

Produtos afetados

Homey Login Register

Referências · 9

• https://themeforest.net/item/homey-booking-wordpress-theme/23338013 · Nota
• https://twitter.com/VulmonFeeds/status/1897362158616187166 · Publicação no Twitter
• https://twitter.com/cybercronai/status/1897362086826528897 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-11951 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/67c4066f-b8bc-4cd0-ae47-844af23e003f?source=cve · Nota
• https://t.me/cvedetector/19629 · Publicação no Telegram
• https://t.me/cvenotify/113549 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/1897248491488899116 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1897506925094355221 · Publicação no Twitter