Vulnerability · Published Jun 6, 2024 · Assigned by Wordfence

CVE-2024-5324XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

High 8.8

In plain English

A high-severity missing authorization in Login & Register Customizer – Popup | Slider | Inline | WooCommerce from xootix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.5%top 25.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Affected products (as reported)

Vendor	Product	Versions
xootix	Waitlist Woocommerce ( Back in stock notifier )	0 – through 2.6
xootix	OTP Login & Register Woocommerce	0 – through 2.6.1
xootix	Side Cart Woocommerce \| Woocommerce Cart	2.5
xootix	Login & Register Customizer – Popup \| Slider \| Inline \| WooCommerce	2.7.1 – through 2.7.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References