What is the severity of CVE-2024-12822?

CVE-2024-12822 is classified as a high severity vulnerability due to the potential for privilege escalation.

How do I fix CVE-2024-12822?

To fix CVE-2024-12822, update the UserPro Media Manager plugin to version 3.12.0 or later.

What systems are affected by CVE-2024-12822?

CVE-2024-12822 affects all versions of the UserPro Media Manager plugin for WordPress up to and including 3.11.0.

What specific issue does CVE-2024-12822 address?

CVE-2024-12822 addresses a missing capability check in the add_capto_img() function that permits unauthorized data modification.

Who is responsible for the vulnerability CVE-2024-12822?

The vulnerability CVE-2024-12822 is attributed to the UserPro plugin developers.

Vulnerability/
CVE-2024-12822

critical

9.8

CWE

862

30/1/2025

CVE-2024-12822: Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update

First published: Thu Jan 30 2025(Updated: )

The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the add_capto_img() function in all versions up to, and including, 3.11.0. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Credit: security@wordfence.com

Affected Software	Affected Version	How to fix
UserPro Media Manager	<=3.12.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-12822?
CVE-2024-12822 is classified as a high severity vulnerability due to the potential for privilege escalation.
How do I fix CVE-2024-12822?
To fix CVE-2024-12822, update the UserPro Media Manager plugin to version 3.12.0 or later.
What systems are affected by CVE-2024-12822?
CVE-2024-12822 affects all versions of the UserPro Media Manager plugin for WordPress up to and including 3.11.0.
What specific issue does CVE-2024-12822 address?
CVE-2024-12822 addresses a missing capability check in the add_capto_img() function that permits unauthorized data modification.
Who is responsible for the vulnerability CVE-2024-12822?
The vulnerability CVE-2024-12822 is attributed to the UserPro plugin developers.

collector/mitre-cve
source/MITRE
collector/nvd-api
source/NVD
agent/last-modified-date
agent/severity
agent/title
agent/references
agent/weakness
agent/author
agent/source
agent/type
agent/description
agent/first-publish-date
agent/event
agent/softwarecombine
agent/tags
agent/guess-ai
agent/software-canonical-lookup
vendor/userpro
canonical/userpro media manager

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.