JetEngine <= 3.2.4 - Authenticated (Contributor+) Privilege Escalation
2023-11-28 00:00
Rafie MuhammadStrategic Overview
Vulnerability Overview
The JetEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.2.4. This is due to an unknown issue. This makes it possible for authenticated attackers, with contributor-level access and above, to gain elevated privileges.
Technical Analysis
REMEDIATION: Update to version 3.2.5, or a newer patched version --- IDENTIFIER: CWE-284 (Improper Access Control) The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C