PT-2024-16559 · WordPress · Wordpress User Extra Fields

Tonn · Published 2024-11-12 · Updated 2024-11-19 · CVE-2024-10800

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress User Extra Fields plugin versions up to, and including, 16.6

Description The WordPress User Extra Fields plugin is vulnerable to privilege escalation due to a missing capability check on the ajax save fields() function. This allows authenticated attackers, with subscriber-level access and above, to add custom fields that can be updated and then use the check and overwrite wp or woocommerce fields function to update the wp capabilities field to have administrator privileges.

Recommendations For WordPress User Extra Fields plugin versions up to, and including, 16.6, update to a version higher than 16.6 to resolve the issue. As a temporary workaround, consider disabling the ajax save fields() function until a patch is available. Restrict access to the check and overwrite wp or woocommerce fields function to minimize the risk of exploitation. Avoid using the wp capabilities field in the affected plugin until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-10800

Affected Products

Wordpress User Extra Fields

References · 9

• https://osv.dev/vulnerability/CVE-2024-10800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10800 · Security Note
• https://t.me/cvenotify/101500 · Telegram Post
• https://twitter.com/CVEnew/status/1856694182905348148 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1856602084772065425 · Twitter Post
• https://codecanyon.net/item/user-extra-fields/12949844 · Note
• https://twitter.com/CveFindCom/status/1856563244300939590 · Twitter Post
• https://t.me/cvedetector/10807 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a18fa7e6-813d-4b48-bd4e-5232fb8382d1?source=cve · Note