CVE-2024-29138

HIGHNuclei

WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-29138 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joachim Jensen Restrict User Access – Membership Plugin with Force restrict-user-access.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through <= 2.5.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 18, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 19, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Restrict User Access – Membership Plugin with Force

Browse Joachim Jensen / Restrict User Access – Membership Plugin with Forcerestrict-user-access

Default status: unaffected

CVE ListThrough 2.5affected

restrict_user_access

Browse dev.institute / restrict_user_access
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Restrict User Access <= 2.5 - Cross-Site ScriptingCVSS 6.1

WordPress Restrict User Access – Membership Plugin with Force versions before 2.6 is vulnerable to Reflected Cross-Site Scripting via the '_rua_section' parameter in the admin level edit page.

Impact

Attackers can execute arbitrary scripts in authenticated admin browsers, potentially leading to session hijacking, privilege escalation, WordPress admin account takeover, malicious plugin installation, and website defacement.

Remediation

Update Restrict User Access plugin to version 2.6 or later.

WeaknessesCWE-79
AuthorsShivam Kamboj
Template tagscvecve2024wordpresswpwp-pluginxssauthenticatedvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
FOFA: body="/plugins/restrict-user-access/"
https://patchstack.com/database/wordpress/plugin/restrict-user-access/vulnerability/wordpress-restrict-user-access-plugin-2-5-reflected-cross-site-scripting-xss-vulnerability https://nvd.nist.gov/vuln/detail/CVE-2024-29138 https://wordpress.org/plugins/restrict-user-access/

Source: ProjectDiscovery

References

3