CVE-2024-11643

The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'AllAccessible_save_settings' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

• CWE-862

• https://plugins.trac.wordpress.org/browser/allaccessible/trunk/allaccessible.php#L249
• https://plugins.trac.wordpress.org/changeset/3202017/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bb65d916-7d9e-4562-ab9b-c7ba012a08fb?source=cve

Published

Dec 4, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11638The Gtbabel WordPress plugin before 6.6.9 does not ensure th…8.8
• CVE-2024-11639An authentication bypass in the admin web console of Ivanti …9.8
• CVE-2024-1164The Brizy – Page Builder plugin for WordPress is vulnerable …5.4
• CVE-2024-11640The VikRentCar Car Rental Management System plugin for WordP…8.8
• CVE-2024-11641The VikBooking Hotel Booking Engine & PMS plugin for WordPre…8.8
• CVE-2024-11642The Post Grid Master – Custom Post Types, Taxonomies & Ajax …9.8
• CVE-2024-11644The WP-SVG WordPress plugin through 0.9 does not validate an…5.9
• CVE-2024-11645The float block WordPress plugin through 1.7 does not saniti…4.8
• CVE-2024-11646A vulnerability classified as critical was found in 1000 Pro…9.8
• CVE-2024-11647A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-11648A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-11649A vulnerability has been found in 1000 Projects Beauty Parlo…9.8