Vulnerability Description
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to set the default role on registration forms. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with a custom role that allows them to register as administrators.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Themekraft | Buddyforms | < 2.8.12 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/changeset/3149760/buddyforms/trunk/includes/aPatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/40760f60-b81a-447b-a2cThird Party Advisory
FAQ
What is CVE-2024-8246?
CVE-2024-8246 is a vulnerability with a CVSS score of 8.8 (HIGH). The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to,...
How severe is CVE-2024-8246?
CVE-2024-8246 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-8246?
Check the references section above for vendor advisories and patch information. Affected products include: Themekraft Buddyforms.