CVE-2024-11911

Summary

CVE-2024-11911: WP Crowdfunding plugin for WordPress, used by over 20,000 sites, is found to be vulnerable. Attackers with Subscriber-level access or higher can exploit a missing capability check in the install_woocommerce_plugin() function, leading to unauthorized plugin installations, specifically WooCommerce. Although WooCommerce is a requirement for the plugin to function properly, this vulnerability poses a risk to site security and functionality. Unpatched sites using versions up to and including 2.1.12 are susceptible to this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.