CVE-2024-5324 (GCVE-0-2024-5324)
Vulnerability from cvelistv5
Published
2024-06-06 02:02
Modified
2026-04-08 16:32
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| xootix | Waitlist Woocommerce ( Back in stock notifier ) |
Version: 0 ≤ 2.6 |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:xootix:login\\/signup_popup:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "login\\/signup_popup",
"vendor": "xootix",
"versions": [
{
"lessThanOrEqual": "2.7.2",
"status": "affected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5324",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-16T18:13:46.920950Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-17T15:49:40.152Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:12.430Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset/3093994/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Waitlist Woocommerce ( Back in stock notifier )",
"vendor": "xootix",
"versions": [
{
"lessThanOrEqual": "2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "OTP Login \u0026 Register Woocommerce",
"vendor": "xootix",
"versions": [
{
"lessThanOrEqual": "2.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Side Cart Woocommerce | Woocommerce Cart",
"vendor": "xootix",
"versions": [
{
"status": "affected",
"version": "2.5"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Login \u0026 Register Customizer \u2013 Popup | Slider | Inline | WooCommerce",
"vendor": "xootix",
"versions": [
{
"lessThanOrEqual": "2.7.2",
"status": "affected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AmrAwad"
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the \u0027import_settings\u0027 function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:32:18.330Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3093994/"
},
{
"url": "https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3111541/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3115392/mobile-login-woocommerce/trunk?contextall=1\u0026old=3084918\u0026old_path=%2Fmobile-login-woocommerce%2Ftrunk"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3117332/"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-06-05T13:11:37.000Z",
"value": "Disclosed"
}
],
"title": "XootiX Framework \u003c= Various Plugin Versions - Missing Authorization to Arbitrary Options Update"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-5324",
"datePublished": "2024-06-06T02:02:48.411Z",
"dateReserved": "2024-05-24T16:18:24.858Z",
"dateUpdated": "2026-04-08T16:32:18.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=cve\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3093994/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T21:11:12.430Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-5324\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-16T18:13:46.920950Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:xootix:login\\\\/signup_popup:*:*:*:*:*:*:*:*\"], \"vendor\": \"xootix\", \"product\": \"login\\\\/signup_popup\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.7.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.7.2\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-16T18:14:52.523Z\"}}], \"cna\": {\"title\": \"XootiX Framework \u003c= Various Plugin Versions - Missing Authorization to Arbitrary Options Update\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"AmrAwad\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"xootix\", \"product\": \"Waitlist Woocommerce ( Back in stock notifier )\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.6\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"xootix\", \"product\": \"OTP Login \u0026 Register Woocommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.6.1\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"xootix\", \"product\": \"Side Cart Woocommerce | Woocommerce Cart\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.5\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"xootix\", \"product\": \"Login \u0026 Register Customizer \\u2013 Popup | Slider | Inline | WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.7.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.7.2\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-06-05T13:11:37.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3093994/\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3111541/\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3115392/mobile-login-woocommerce/trunk?contextall=1\u0026old=3084918\u0026old_path=%2Fmobile-login-woocommerce%2Ftrunk\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3117332/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the \u0027import_settings\u0027 function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-04-08T16:32:18.330Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-5324\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-08T16:32:18.330Z\", \"dateReserved\": \"2024-05-24T16:18:24.858Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2024-06-06T02:02:48.411Z\", \"assignerShortName\": \"Wordfence\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…