Vulnerability · Published Sep 25, 2024 · Assigned by Wordfence
CVE-2024-8349Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation
High 7.2
In plain English
A high-severity missing authorization in Uncanny Groups for LearnDash from Uncanny Owl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group leader-level access and above, to change admin account email addresses which can subsequently lead to admin account access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Uncanny Owl | Uncanny Groups for LearnDash | 0 – through 6.1.0.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H