CVE-2024-9192
WP Video Robot <= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
WP Video Robot <= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due to insufficient validation on user meta that can be updated in the wpvr_rate_request_result() function in all versions up to, and including, 1.20.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta on a WordPress site. This can be leveraged to update their capabilities to that of an administrator.
Reserved 2024-09-25 | Published 2024-11-16 | Updated 2024-11-19 | Assigner WordfenceCWE-269 Improper Privilege Management
| 2024-11-15: | Disclosed |
Tonn
www.wordfence.com/...-4aca-485a-aa0c-73728dc1e7c1?source=cve
codecanyon.net/item/wordpress-video-robot-plugin/8619739
Support options
