WordPress Plugin Vulnerabilities

XStore Core <= 5.3.5 - Unauthenticated Privilege Escalation

Description

The XStore Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.3.5. This makes it possible for unauthenticated attackers to gain higher privileged access to a vulnerable site.

Affects Plugins

Plugin icon
et-core-plugin
No known fix

References

CVE
CVE-2024-33552
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7019b542-9b9a-4d16-94a0-412cccf1e6eb

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
c7578679-43a2-413d-beb3-b8fbc617a3b8

Timeline

Publicly Published
2024-04-25 (about 1 year ago)
Added
2024-05-01 (about 1 year ago)
Last Updated
2024-05-01 (about 1 year ago)

Other

Published
Title
Published
2023-12-26
Title
Ultimate Addons for Beaver Builder < 1.35.15 - Contributor+ Privilege Escalation
Published
2024-02-17
Title
Login as User or Customer <= 3.8 - Admin Account Takeover
Published
2025-02-27
Title
DHVC Form < 2.4.8 - Unauthenticated Privilege Escalation
Published
2026-02-18
Title
Lizza LMS Pro < 1.0.4 - Unauthenticated Privilege Escalation
Published
2020-02-17
Title
wpCentral < 1.5.1 - Improper Access Control to Privilege Escalation