Login Request a demo
High severity · published Jun 6, 2024
CVE-2024-5324
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings'…
8.8
CVSS
1.5%
EPSS
No
On KEV
Description
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LP
Login/signup Popup · Xootix
2.7.1; 2.7.2 · source: NVD
OL
Otp Login Woocommerce & Gravity Forms · Xootix
before 2.6.2 · source: NVD
SC
Side Cart Woocommerce · Xootix
2.5 · source: NVD
WW
Waitlist Woocommerce · Xootix
before 2.6.1 · source: NVD
Affected product
LP
Login/signup Popup
Xootix
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5324
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5324
Patch
https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83
Patch
https://plugins.trac.wordpress.org/changeset/3093994/
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3111541/
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3115392/mobile-login-woocommerce/trunk?contextall=1&old=3084918&old_path=%2Fmobile-login-woocommerce%2Ftrunk
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3117332/
More from Login/signup Popup
8.8
CVE-2022-0215
The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery…
5.4
CVE-2025-1064
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode in all versions up…
4.6
CVE-2020-36715
The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4
4.3
CVE-2024-5665
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’…