PT-2024-17210 · Dynamiapps · Frontend Admin By Dynamiapps
B0Lli
+1
·
Published
2024-12-14
·
Updated
2024-12-19
·
CVE-2024-11721
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
The Frontend Admin by DynamiApps plugin for WordPress versions up to, and including, 3.24.5
Description
The issue is due to insufficient controls on the
Role field in a form, allowing unauthenticated attackers to create new administrative user accounts. This vulnerability affects the Frontend Admin by DynamiApps plugin for WordPress, making it possible for attackers to escalate privileges even when the administrative user role has not been provided as an option to the user, granted that unauthenticated users have been provided access to the form.Recommendations
For versions up to, and including, 3.24.5, update to a version later than 3.24.5 to mitigate the risk of privilege escalation.
As a temporary workaround, consider restricting access to the form that utilizes the
Role field to prevent unauthenticated users from creating new administrative user accounts.
Avoid providing access to the form to unauthenticated users until the issue is resolved.Fix
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Frontend Admin By Dynamiapps