CVE-2024-9519: The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in…

PriorityP345high7.2CVSS 3.1

AVNACLPRHUINSUCHIHAH

EPSS

0.45%

36.1th percentile

The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update the registration form role to administrator, which leads to privilege escalation.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
userplus	user_registration_user_profile_userplus	<= 2.0	—
wpuserplus	userplus	<= 2.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.