CVE-2024-12293
Published
CVSS v3
8.8
HIGH
CVSS v2
N/A
Affected
1
PROJECT
Description
The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or incorrect nonce validation on the update_roles() function. This makes it possible for unauthenticated attackers to add or remove roles for arbitrary users, including escalating their privileges to administrator, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
<p>User Role Editor WordPress plugin allows you to change user roles and capabilities easy.<br />
Just turn on check boxes of capabilities you wish to add to the selected role and click “Update” button to save your changes. That’s done.<br />
Add new roles and customize its capabilities according to your needs, from scratch of as a copy of other existing role.<br />
Unnecessary self-made role can be deleted if there are no users whom such role is assigned.<br />
Role assigned every new created user by default may be changed too.<br />
Capabilities could be assigned on per user basis. Multiple roles could be assigned to user simultaneously.<br />
You can add new capabilities and remove unnecessary capabilities which could be left from uninstalled plugins.<br />
Multi-site support is provided.</p>
<p>To read more about ‘User Role Editor’ visit <a href="https://www.shinephp.com/user-role-editor-wordpress-plugin/" rel="nofollow ugc">this page</a></p>
<p>Do you need more functionality with quality support in a real time? Do you wish to remove advertisements from User Role Editor pages?<br />
<a href="https://www.role-editor.com" rel="nofollow ugc">Buy Pro version</a>.<br />
<a href="https://www.role-editor.com" rel="nofollow ugc">User Role Editor Pro</a> includes extra modules:</p>
<ul>
<li>Block selected admin menu items for role.</li>
<li>Hide selected front-end menu items for no logged-in visitors, logged-in users, roles.</li>
<li>Block selected widgets under “Appearance” menu for role.</li>
<li>Show widgets at front-end for selected roles.</li>
<li>Block selected meta boxes (dashboard, posts, pages, custom post types) for role.</li>
<li>“Export/Import” module. You can export user role to the local file and import it to any WordPress site or other sites of the multi-site WordPress network.</li>
<li>Roles and Users permissions management via Network Admin for multisite configuration. One click Synchronization to the whole network.</li>
<li>“Other roles access” module allows to define which other roles user with current role may see at WordPress: dropdown menus, e.g assign role to user editing user profile, etc.</li>
<li>Manage user access to editing posts/pages/custom post type using posts/pages, authors, taxonomies ID list.</li>
<li>Per plugin users access management for plugins activate/deactivate operations.</li>
<li>Per form users access management for Gravity Forms plugin.</li>
<li>Shortcode to show enclosed content to the users with selected roles only.</li>
<li>Posts and pages view restrictions for selected roles.</li>
<li>Admin back-end pages permissions viewer</li>
</ul>
<p>Pro version is advertisement free. Premium support is included.</p>
<h3>Additional Documentation</h3>
<p>You can find more information about “User Role Editor” plugin at <a href="http://www.shinephp.com/user-role-editor-wordpress-plugin/" rel="nofollow ugc">this page</a></p>
<p>I am ready to answer on your questions about plugin usage. Use <a href="http://www.shinephp.com/user-role-editor-wordpress-plugin/" rel="nofollow ugc">plugin page comments</a> for that.</p>
WordPress Plugin Directory