CVE-2024-9235: Mapster WP Maps <= 1.5.0 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update
The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an insufficient capability check on the mapsterwpmapssetoptionfromjs() function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with contributor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9235?
CVE-2024-9235 has been classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-9235?
To fix CVE-2024-9235, update the Mapster WP Maps plugin to version 1.6.0 or later.
What function is affected by CVE-2024-9235?
CVE-2024-9235 affects the mapster_wp_maps_set_option_from_js() function.
What can happen if CVE-2024-9235 is exploited?
Exploiting CVE-2024-9235 can lead to unauthorized modification of data and privilege escalation.
Which versions of Mapster WP Maps are affected by CVE-2024-9235?
All versions of Mapster WP Maps up to and including 1.5.0 are affected by CVE-2024-9235.