CVE-2024-12202

Summary

CVE-2024-12202 is a vulnerability affecting the Croma Music plugin for WordPress. It allows authenticated attackers with Subscriber-level access or higher to bypass a capability check on the 'ironMusic_ajax' function, leading to unauthorized data modification. This can result in privilege escalation, giving attackers the ability to update arbitrary options on vulnerable WordPress sites. Potentially harmful consequences include setting the default role for registration to administrator and enabling user registration for attackers, allowing them to gain administrative user access. All versions up to and including 3.6 of the Croma Music plugin are impacted by this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.