The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
References
Configurations
Configuration 1 (hide)
|
History
24 Jul 2024, 17:42
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83 - Patch | |
| References | () https://plugins.trac.wordpress.org/changeset/3093994/ - Patch | |
| CPE | cpe:2.3:a:xootix:waitlist_woocommerce:*:*:*:*:*:wordpress:*:* cpe:2.3:a:xootix:login\/signup_popup:2.7.2:*:*:*:*:wordpress:*:* cpe:2.3:a:xootix:side_cart_woocommerce:2.5:*:*:*:*:wordpress:*:* cpe:2.3:a:xootix:login\/signup_popup:2.7.1:*:*:*:*:wordpress:*:* cpe:2.3:a:xootix:otp_login_woocommerce_\&_gravity_forms:*:*:*:*:*:wordpress:*:* |
|
| CWE | CWE-863 | |
| First Time |
Xootix side Cart Woocommerce
Xootix Xootix login\/signup Popup Xootix otp Login Woocommerce \& Gravity Forms Xootix waitlist Woocommerce |
06 Jun 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-06 02:15
Updated : 2024-07-24 17:42
NVD link : CVE-2024-5324
Mitre link : CVE-2024-5324
JSON object : View
Products Affected
xootix
- side_cart_woocommerce
- waitlist_woocommerce
- login\/signup_popup
- otp_login_woocommerce_\&_gravity_forms
CWE
CWE-863
Incorrect Authorization