CVE-2024-12129

Summary

CVE-2024-12129 is a vulnerability affecting the Royal Core plugin for WordPress. This issue allows authenticated attackers, with Subscriber-level access and above, to modify options arbitrarily on a WordPress site due to a missing capability check on the 'royal_restore_backup' function. This can be exploited to elevate privileges and update the default role for registration to administrator, granting attackers administrative user access to the vulnerable site. All versions up to and including 2.9.2 are affected.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.