CVE-2024-12821

CVE-2024-12821 affects the Media Manager for UserPro plugin for WordPress in all versions up to and including 3.12.0. The vulnerability arises from a missing capability check on the upm_upload_media() function, enabling unauthorized modification of data that leads to privilege escalation. It is classified under CWE-862 (Missing Authorization) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low complexity, and potential for high impact across confidentiality, integrity, and availability.

Authenticated attackers with Subscriber-level access or higher can exploit this issue over the network without user interaction. By calling the vulnerable function, they can update arbitrary WordPress site options, such as modifying the default role for new user registrations to administrator and enabling registration. This allows attackers to self-register with administrative privileges, achieving full site compromise.

Advisories from Wordfence provide detailed threat intelligence on the vulnerability, while the plugin's CodeCanyon page offers additional context on the affected component. Security practitioners should consult these references for mitigation guidance, including potential patches beyond version 3.12.0, and audit sites using the plugin for unauthorized option changes.