CVE-2024-6624
JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation
- State
- Published
- Severity
- 9.8 Critical
- Published
- Jul 11, 2024
- Updated
- Apr 8, 2026
- Reserved
- Jul 9, 2024
Description
The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin requires the JSON API plugin to also be installed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Wordfence |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
JSON API Userparorrey |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a26f60-5912-4d4a-8ef8-e4357c1fb1ff?source=cve
- https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L51
- https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L187
- https://plugins.trac.wordpress.org/changeset/3115185/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.