CVE-2024-12259

The CRM WordPress Plugin – RepairBuddy plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.8120. This is due to the plugin not properly validating a user's identity prior to updating their email through the wc_update_user_data AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204501%40computer-repair-shop&new=3204501%40computer-repair-shop&sfp_email=&sfph_mail=
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206568%40computer-repair-shop&new=3206568%40computer-repair-shop&sfp_email=&sfph_mail=#file548
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208270%40computer-repair-shop&new=3208270%40computer-repair-shop&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/80997d2f-3e16-48f6-969b-58844cb83d53?source=cve

Published

Dec 18, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12253The Simple Ecommerce Shopping Cart Plugin- Sell products thr…5.4
• CVE-2024-12254Starting in Python 3.12.0, the asyncio._SelectorSocketTransp…8.7
• CVE-2024-12255The Accept Stripe Payments Using Contact Form 7 plugin for W…5.3
• CVE-2024-12256The Simple Video Management System plugin for WordPress is v…6.1
• CVE-2024-12257The CardGate Payments for WooCommerce plugin for WordPress i…6.1
• CVE-2024-12258The WP Service Payment Form With Authorize.net plugin for Wo…6.1
• CVE-2024-1226The software does not neutralize or incorrectly neutralizes …7.5
• CVE-2024-12260The Ultimate Endpoints With Rest Api plugin for WordPress is…6.1
• CVE-2024-12261The SmartEmailing.cz plugin for WordPress is vulnerable to R…6.1
• CVE-2024-12262The Ebook Store plugin for WordPress is vulnerable to Reflec…6.1
• CVE-2024-12263The Child Theme Creator by Orbisius plugin for WordPress is …4.3
• CVE-2024-12264The PayU CommercePro Plugin plugin for WordPress is vulnerab…9.8