PT-2025-1859 · WordPress · Sakolawp

Thanh Nam Tran · Published 2025-01-07 · Updated 2025-01-12 · CVE-2024-12470

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions School Management System – SakolaWP plugin for WordPress versions up to and including 1.0.8

Description The issue is due to the registration function not properly limiting what roles a user can register as, making it possible for unauthenticated attackers to register as an administrative user. This allows attackers to escalate privileges.

Recommendations For versions up to and including 1.0.8, update to version 1.0.9 to resolve the issue. As a temporary workaround, consider restricting access to the registration function until the update is applied.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2024-12470

Affected Products

Sakolawp

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-12470 · Security Note
• https://twitter.com/CVEnew/status/1876487512941564359 · Twitter Post
• https://t.me/cvedetector/14446 · Telegram Post
• https://wordpress.org/plugins/sakolawp-lite · Note
• https://twitter.com/CveFindCom/status/1876486914921918812 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/db1c581b-5cc9-46c0-ba5d-605642697729?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1876511275573764280 · Twitter Post
• https://twitter.com/cracbot/status/1878321081729405058 · Twitter Post