PT-2024-17151 · WordPress · Accessibility By Allaccessible

1337_Wannabe

+1

·

Published

2024-12-04

·

Updated

2024-12-09

·

CVE-2024-11643

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Accessibility by AllAccessible plugin for WordPress versions up to, and including, 1.3.4
Description The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the AllAccessible save settings function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Recommendations For versions up to, and including, 1.3.4, update to a version that includes a fix for this issue. As a temporary workaround, consider disabling the AllAccessible save settings function until a patch is available. Restrict access to the WordPress site to minimize the risk of exploitation. Avoid using the Accessibility by AllAccessible plugin until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-11643

Affected Products

Accessibility By Allaccessible