blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-9265

CRITICAL 9.8 CVSS 3.1
Published
October 1, 2024
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
security@wordfence.com
Weakness
CWE-269
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. This is due to the plugin not properly restricting the roles that can set during registration through the echo_check_post_header_sent() function. This makes it possible for unauthenticated attackers to register as an administrator.

Affected products and versions

  • CodeRevolution Echo RSS Feed Post Generator — Up to and including 5.4.6
  • coderevolution echo_rss_feed_post_generator — Up to and including 5.4.6
  • coderevolution echo_rss_feed_post_generator — Before 5.4.7

References

  • codecanyon.net https://codecanyon.net/item/echo-rss-feed-post-generator-plugin-for-wordpress/19486974 Product
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/c099f401-4b05-4532-8e31-af1b1dea7eca?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record