PT-2024-39523 · WordPress · Echo Rss Feed Post Generator
Tonn
·
Published
2024-10-01
·
Updated
2024-10-07
·
CVE-2024-9265
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
The Echo RSS Feed Post Generator plugin for WordPress versions up to, and including, 5.4.6
Description
The issue is related to privilege escalation due to the plugin not properly restricting the roles that can be set during registration through the
echo check post header sent() function. This allows unauthenticated attackers to register as administrators.Recommendations
For versions up to, and including, 5.4.6, update to a version that contains a fix for this issue. As a temporary workaround, consider disabling the
echo check post header sent() function until a patch is available. Restrict access to the registration process to minimize the risk of exploitation. Avoid using the vulnerable registration functionality until the issue is resolved.Fix
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Echo Rss Feed Post Generator