Zephyr Project Manager, CVE-2024-7624

CVE, Research URL: CVE-2024-7624
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Published on: Aug 15, 2024
Research Description: The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_access() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings.
Affected versions: Min -, max 3.3.102.
Status: vulnerable