CVE-2024-7624: Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation
The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the updateuseraccess() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7624?
The severity of CVE-2024-7624 is classified as a limited privilege escalation vulnerability.
How do I fix CVE-2024-7624?
To fix CVE-2024-7624, update the Zephyr Project Manager plugin to version 3.3.102 or later.
Which versions of the Zephyr Project Manager plugin are affected by CVE-2024-7624?
All versions of the Zephyr Project Manager plugin up to and including 3.3.101 are affected by CVE-2024-7624.
What can attackers do by exploiting CVE-2024-7624?
By exploiting CVE-2024-7624, attackers can escalate privileges and gain unauthorized access to the plugin's settings.
Is there a workaround for CVE-2024-7624 before updating?
A potential workaround for CVE-2024-7624 is to restrict user access and capabilities manually until the plugin is updated.