CVE-2024-2172

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-304

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-217226.3The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.CVE-2024-217234.3Inadequate parsing of URLs could result into an open redirect.CVE-2024-217246.1Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.CVE-2024-217256.1Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.CVE-2024-217266.5Inadequate content filtering leads to XSS vulnerabilities in various components.CVE-2024-217276.1XSS vulnerability in DP Calendar component for Joomla.CVE-2024-217286.1An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that prov CVE-2024-217296.1Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.CVE-2024-21738.8Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access CVE-2024-217305.4The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.CVE-2024-217316.1Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.CVE-2024-217326.1FlyCms through abbaa5a allows XSS via the permission management feature.