KH Easy User Settings <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation
Strategic Overview
<= 1.0.0CVE-2024-54365Vulnerability Overview
The KH Easy User Settings plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain elevated access to a site.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-269 (Improper Privilege Management) The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C