9.8

CVE-2024-13421

Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator

The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account.
Mögliche Gegenmaßnahme
Real Estate 7 WordPress: Update to version 3.5.2, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Theme
≫
Produkt Real Estate 7 WordPress
Version *-3.5.1
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Contempothemes ≫ Real Estate 7 SwPlatformwordpress Version < 3.5.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.75% 0.727
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.