CVE-2024-6624

This PoC exploits an unauthenticated privilege escalation vulnerability in the WordPress JSON API User plugin (versions <= 3.9.3) by registering a new user and then updating their metadata to grant administrator privileges. The exploit leverages improper controls on custom user meta fields.

This Python script exploits CVE-2024-6624, an unauthenticated privilege escalation vulnerability in the JSON API User WordPress plugin (versions <= 3.9.3). It automates user registration and privilege escalation to administrator by leveraging insecure nonce generation and user meta updates.