CVE-2024-12293

Summary

CVE-2024-12293 is a Cross-Site Request Forgery vulnerability affecting the User Role Editor plugin for WordPress. Versions up to and including 4.64.3 are vulnerable, due to erroneous or absent nonce validation in the update_roles() function. This flaw enables unauthenticated attackers to manipulate user roles by tricking site administrators into clicking a malicious link, potentially escalating privileges to administrator level.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.