blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-5324

HIGH 8.8 CVSS 3.1
Published
June 6, 2024
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-862, CWE-863
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Affected WordPress components

  • Login & Register Customizer – Forms, Popup, Profile & WooCommerce Plugin · easy-login-woocommerce
    Confirmed match Active
    From 2.7.1 (including) to 2.7.2 (including)
    View on WordPress.org
  • OTP Login & Register Woocommerce Plugin · mobile-login-woocommerce
    Confirmed match Active
    Up to and including 2.6.1
    View on WordPress.org
  • Waitlist Woocommerce ( Back in stock notifier ) Plugin · waitlist-woocommerce
    Confirmed match Active
    Up to and including 2.6
    View on WordPress.org
  • Side Cart Woocommerce | Woocommerce Cart Plugin · side-cart-woocommerce
    Possible match Active
    Version 2.5
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • xootix Waitlist Woocommerce ( Back in stock notifier ) — Up to and including 2.6
  • xootix OTP Login & Register Woocommerce — Up to and including 2.6.1
  • xootix Side Cart Woocommerce | Woocommerce Cart — Version 2.5
  • xootix Login & Register Customizer – Popup | Slider | Inline | WooCommerce — From 2.7.1 (including) to 2.7.2 (including)
  • xootix login\/signup_popup — From 2.7.1 (including) to 2.7.2 (including)
  • xootix login\/signup_popup — Version 2.7.1
  • xootix login\/signup_popup — Version 2.7.2
  • xootix otp_login_woocommerce_\&_gravity_forms — Before 2.6.2
  • xootix side_cart_woocommerce — Version 2.5
  • xootix waitlist_woocommerce — Before 2.6.1

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83 Patch
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3093994/ Patch
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3111541/
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3115392/mobile-login-woocommerce/trunk?contextall=1&old=3084918&old_path=%2Fmobile-login-woocommerce%2Ftrunk
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3117332/
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record