CVE-2024-10800

Summary

CVE-2024-10800 is a privilege escalation vulnerability affecting the WordPress User Extra Fields plugin. The issue lies in the ajax_save_fields() function, which fails to perform sufficient capability checks. Consequently, authenticated attackers, including those with subscriber-level access, can exploit this flaw by adding custom fields and subsequently update the wp_capabilities field to grant administrator privileges. This vulnerability poses a significant risk to WordPress installations using the User Extra Fields plugin in versions up to and including 16.6.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.