THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-3668

PowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege Escalation

Reserved:2024-04-11
Published:2024-06-08
Updated:2024-06-10

Description

The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with administrator set as the default role and then register as an administrator.



HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-732 Incorrect Permission Assignment for Critical Resource

Product status

Default status
unaffected

*
affected

Timeline

2024-06-07:Disclosed

Credits

Ankit Patel finder

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/249ccc77-0daf-41bc-b5c5-991bf17d645d?source=cve

https://powerpackelements.com/change-logs/

cve.org CVE-2024-3668

nvd.nist.gov CVE-2024-3668

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-3668