Auth bypass in Xootix Login & Register Customizer – Popup | Slider Inline Woocommerce
CVE-2024-5324
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (73.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Xootix Login & Register Customizer – Popup | Slider Inline Woocommerce — versions 2.7.1
- Xootix Login\/signup Popup — versions 2.7.1, 2.7.2
- Xootix Otp Login & Register Woocommerce — versions 0
- Xootix Otp Login Woocommerce \& Gravity Forms
- Xootix Side Cart Woocommerce — versions 2.5
- Xootix Side Cart Woocommerce | — versions 2.5
- Xootix Waitlist Woocommerce
- Xootix Waitlist Woocommerce ( Back In Stock Notifier ) — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c… (Third Party Advisory)
- plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-fr… (Patch)
- plugins.trac.wordpress.org/changeset/3093994/ (Patch)
- plugins.trac.wordpress.org/browser/side-cart-woocommerce/trunk/includes/xoo-fra…
- plugins.trac.wordpress.org/changeset/3111541/
- plugins.trac.wordpress.org/changeset/3115392/mobile-login-woocommerce/trunk
- plugins.trac.wordpress.org/changeset/3117332/
Frequently asked questions
- What is CVE-2024-5324?
- CVE-2024-5324 is a high-severity vulnerability in Xootix Login & Register Customizer – Popup | Slider Inline Woocommerce, classified under Missing Authorization. CVSS score: 8.8/10. Published 2024-06-06.
- How severe is CVE-2024-5324?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-5324 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.