WordPress Plugin Vulnerabilities

WPGuppy < 1.1.1 - Subscriber+ Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
wpguppy-lite
Fixed in 1.1.1

References

CVE
CVE-2024-56280
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/49eaee21-15c0-4c43-857d-05f0993509ea

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.8 (high)

Miscellaneous

Original Researcher
I8BL
Verified
No
WPVDB ID
eb346958-61cf-4fb6-85ca-c710926420c5

Timeline

Publicly Published
2025-01-03 (about 1 year ago)
Added
2025-01-13 (about 1 year ago)
Last Updated
2025-01-13 (about 1 year ago)

Other

Published
Title
Published
2026-06-08
Title
Events Calendar for GeoDirectory < 2.3.29 - Subscriber+ Privilege Escalation
Published
2023-08-03
Title
WP Ultimate CSV Importer < 7.9.9 - Author+ Privilege Escalation
Published
2025-11-24
Title
EduKart Pro <= 1.0.3 - Unauthenticated Privilege Escalation
Published
2026-09-23
Title
Paytium: Mollie payment forms & donations < 5.0.4 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
Published
2024-08-02
Title
JetFormBuilder < 3.3.4.2 - Authenticated (Administrator+) Privilege Escalation