PT-2024-37753 · WordPress · Json Api User+1

Thanh Nam Tran · Published 2024-07-11 · Updated 2024-07-12 · CVE-2024-6624

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JSON API User plugin for WordPress versions up to, and including, 3.9.3

Description The issue is due to improper controls on custom user meta fields, making it possible for unauthenticated attackers to register as administrators on the site. The plugin requires the JSON API plugin to also be installed.

Recommendations For versions up to, and including, 3.9.3, update to a version later than 3.9.3 to resolve the issue. As a temporary workaround, consider disabling the custom user meta fields feature until a patch is available. Restrict access to the user registration process to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-6624

Affected Products

Json Api

Json Api User

References · 11

• https://osv.dev/vulnerability/CVE-2024-6624 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6624 · Security Note
• https://plugins.trac.wordpress.org/changeset/3115185 · Patch
• https://twitter.com/VulmonFeeds/status/1811351623676895527 · Twitter Post
• https://twitter.com/CVEnew/status/1811322649102160274 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a4a26f60-5912-4d4a-8ef8-e4357c1fb1ff?source=cve · Note
• https://t.me/cvedetector/640 · Telegram Post
• https://t.me/cvenotify/86078 · Telegram Post
• https://t.me/cvenotify/85786 · Telegram Post
• https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L51 · Note
• https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L187 · Note