PT-2025-9073 · WordPress · Dhvc Form

Tonn · Published 2025-02-28 · Updated 2025-03-05 · CVE-2024-8420

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DHVC Form plugin for WordPress versions prior to 2.4.8

Description The issue allows unauthenticated attackers to register as administrators on sites due to the plugin permitting users to supply the role field when registering.

Recommendations For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the user registration functionality until the update is applied.

Fix

LPE

Improper Privilege Management

Incorrect Privilege Assignment

Weakness Enumeration

CWE-269

CWE-266

Related Identifiers

CVE-2024-8420

Affected Products

Dhvc Form

References · 10

• https://osv.dev/vulnerability/CVE-2024-8420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8420 · Security Note
• https://twitter.com/VulmonFeeds/status/1895472520863584414 · Twitter Post
• https://codecanyon.net/item/dhvc-form-wordpress-form-for-visual-composer/8326593 · Note
• https://twitter.com/CVEnew/status/1895619327136845826 · Twitter Post
• https://twitter.com/CveFindCom/status/1895391598172570106 · Twitter Post
• https://t.me/cvedetector/19143 · Telegram Post
• https://twitter.com/cracbot/status/1897240759587450897 · Twitter Post
• https://twitter.com/vulns_space/status/1895408693618839980 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e4d51a0c-c625-4732-b345-df02971fbffa?source=cve · Note