Auth bypass in Xootix Login & Register Customizer – Popup | Slider Inline Woocommerce
CVE-2024-5324
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Vulnerability class: Broken Access Control
EPSS: 0.015 (71.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Xootix Login & Register Customizer – Popup | Slider Inline Woocommerce — versions 2.7.1
- Xootix Login\/signup_popup — versions 2.7.1, 2.7.2
- Xootix Otp Login & Register Woocommerce — versions 0
- Xootix Otp_login_woocommerce_\&_gravity_forms
- Xootix Side_cart_woocommerce — versions 2.5
- Xootix Side Cart Woocommerce | — versions 2.5
- Xootix Waitlist_woocommerce
- Xootix Waitlist Woocommerce ( Back In Stock Notifier ) — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@wordfence.com (Third Party Advisory)
- security@wordfence.com (Patch)
- security@wordfence.com (Patch)
- security@wordfence.com
- security@wordfence.com
- security@wordfence.com
- security@wordfence.com
Frequently asked questions
- What is CVE-2024-5324?
- CVE-2024-5324 is a high-severity vulnerability in Xootix Login & Register Customizer – Popup | Slider Inline Woocommerce, classified under Missing Authorization. CVSS score: 8.8/10. Published 2024-06-06.
- How severe is CVE-2024-5324?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-5324 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.