CVE-2024-8485: The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the…

PriorityP268critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.57%

43.0th percentile

The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it possible for unauthenticated attackers to update arbitrary user's accounts, including their email to a @weixin.com email, which can the be leveraged to reset the password of the user's account, including administrators.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
jianbo	rest_api_to_miniprogram	<= 4.7.1	—
xjb	rest_api_to_miniprogram	<= 4.7.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.