CVE-2023-4404
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This allows unauthenticated attackers to specify their user role by supplying the 'role' parameter during registration.
Risk Assessment
Organizations may be exposed to unauthorized access to user accounts with elevated privileges, potentially leading to serious security breaches.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and implement additional security measures to restrict access to the registration function.
Original NVD description (English source)
The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.