by Kastro
Paper/Archive/CVE-2024-9265

CVE-2024-9265

CodeRevolution Echo RSS Feed Post Generator — Echo RSS Feed Post Generator <= 5.4.6 - Unauthenticated Privilege Escalation

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 49.7.497 × 209.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. This is due to the plugin not properly restricting the roles that can set during registration through the echo_check_post_header_sent() function. This makes it possible for unauthenticated attackers to register as an administrator.

Affected

ProductAffectedFixed inSource
Echo RSS Feed Post Generator≤ 5.4.6–CNA
echo_rss_feed_post_generator≤ 5.4.6–CISA-ADP

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/c099f401-4b05-4532-8e31-af1b1dea7eca?source=cverefcodecanyon.net/item/echo-rss-feed-post-generator-plugin-for-wordpress/19486974