CVE-2024-51888
Published: 21 January 2025
Description
Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login Register: from n/a through <= 2.4.0.
Security Summary
CVE-2024-51888 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Homey Login Register WordPress plugin developed by favethemes. The flaw enables privilege escalation and affects all versions of the plugin from its initial release through 2.4.0.
With a CVSS v3.1 base score of 9.8 (Critical), the vulnerability is exploitable over the network (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). Unauthenticated remote attackers can leverage this issue to escalate their privileges within affected WordPress installations.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/homey-login-register/vulnerability/wordpress-homey-login-register-plugin-2-4-0-privilege-escalation-vulnerability?_s_id=cve provides details on the vulnerability, recommending updates to patched versions of the Homey Login Register plugin beyond 2.4.0 as the primary mitigation.
Details
- CWE(s)