CVE-2024-6698: FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the updateusermeta function. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta which can be leveraged to update their capabilities to gain administrator access.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6698?
The severity of CVE-2024-6698 is classified as a privilege escalation vulnerability, affecting all versions up to and including 1.7.0 of the FundEngine plugin.
How do I fix CVE-2024-6698?
To fix CVE-2024-6698, update the FundEngine plugin to version 1.7.1 or later.
Who is affected by CVE-2024-6698?
Authenticated attackers with certain privileges can exploit CVE-2024-6698 in the FundEngine plugin on affected WordPress sites.
What causes CVE-2024-6698?
CVE-2024-6698 is caused by the FundEngine plugin not properly verifying user meta updated through the update_user_meta function.
Is there a patch for CVE-2024-6698?
Yes, a patch for CVE-2024-6698 is included in the updated version 1.7.1 of the FundEngine plugin.