CVE-2024-8420

CRITICAL

DHVC Form <= 2.4.7 - Unauthenticated Privilege Escalation

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-8420 has a selected CVSS score of 9.8 (critical).

Description

The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on sites.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 4, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 28, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

DHVC Form

Browse SiteSao / DHVC Form

Default status: unaffected

CVE List, VulnCheckThrough 2.4.7affected

References

3