PT-2025-1960 · WordPress · Media Manager For Userpro

Lucio Sá · Published 2025-01-30 · Updated 2025-02-28 · CVE-2024-12822

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Media Manager for UserPro plugin for WordPress versions up to, and including, 3.11.0

Description The issue concerns unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the add capto img() function. This allows unauthenticated attackers to update arbitrary options on the WordPress site, potentially enabling them to update the default role for registration to administrator and gain administrative user access to a vulnerable site.

Recommendations For versions up to, and including, 3.11.0, update to a version higher than 3.11.0 to resolve the issue. As a temporary workaround, consider disabling the add capto img() function until a patch is available. Restrict access to the WordPress site to minimize the risk of exploitation.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-12822

Affected Products

Media Manager For Userpro

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-12822 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12822 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/a57b2afa-b943-419f-9819-d7b6835c4d10?source=cve · Note
• https://t.me/cvenotify/112921 · Telegram Post
• https://twitter.com/CVEnew/status/1884962378262978826 · Twitter Post
• https://codecanyon.net/item/media-manager-for-userpro/8664618 · Note
• https://twitter.com/VulmonFeeds/status/1885030233511751789 · Twitter Post
• https://t.me/cvedetector/16787 · Telegram Post
• https://twitter.com/CveFindCom/status/1884965586549064116 · Twitter Post