CVE-2024-5324: XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'importsettings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5324?
CVE-2024-5324 has been classified as a critical vulnerability due to the potential for unauthorized data modification by authenticated attackers.
How do I fix CVE-2024-5324?
To fix CVE-2024-5324, update the Login/Signup Popup plugin to version 2.7.3 or later, where the vulnerability has been patched.
Who is affected by CVE-2024-5324?
CVE-2024-5324 affects users of the Login/Signup Popup plugin for WordPress versions 2.7.1 to 2.7.2.
What type of attacks does CVE-2024-5324 enable?
CVE-2024-5324 enables authenticated attackers to modify settings without proper authorization due to a missing capability check.
Can I find more information about CVE-2024-5324?
Yes, you can find detailed information regarding CVE-2024-5324 in vulnerability databases and security advisories.