CVE-2024-8349

HIGH

Uncanny Groups for LearnDash <6.1.0.1 - Privilege Escalation

Title source: llm

Description

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group leader-level access and above, to change admin account email addresses which can subsequently lead to admin account access.

Exploits (1)

nomisec WRITEUP

by karlemilnikka · poc

https://github.com/karlemilnikka/CVE-2024-8349-and-CVE-2024-8350

View Code ZIP pw:eip

References (2)

[Third Party Advisory] https://github.com/karlemilnikka/CVE-2024-8349-and-CVE-2024-8350

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/64cf0ae2-8d66-40d1-8bb6-0cab1dafab0d?source=cve

Scores

CVSS v3 7.2

EPSS 0.0397

EPSS Percentile 88.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-862

Status published

Products (2)

Uncanny Owl/Uncanny Groups for LearnDash < 6.1.0.1

uncannyowl/uncanny_groups_for_learndash < 6.1.1

Published Sep 25, 2024

Tracked Since Feb 18, 2026