nvd-json-data-feeds/CVE-2024/CVE-2024-134xx/CVE-2024-13421.json

{
  "id": "CVE-2024-13421",
  "sourceIdentifier": "security@wordfence.com",
  "published": "2025-02-12T05:15:11.653",
  "lastModified": "2025-02-25T04:00:16.123",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account."
    },
    {
      "lang": "es",
      "value": "El tema Real Estate 7 WordPress para WordPress es vulnerable a la escalada de privilegios en todas las versiones hasta incluida, 3.5.1. Esto se debe a que el complemento no restringe correctamente los roles que se pueden seleccionar durante el registro. Esto hace posible que atacantes no autenticados registren una nueva cuenta de usuario administrativo."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "security@wordfence.com",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "security@wordfence.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-266"
        }
      ]
    },
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:contempothemes:real_estate_7:*:*:*:*:*:wordpress:*:*",
              "versionEndExcluding": "3.5.2",
              "matchCriteriaId": "9B9F8431-754A-4DDE-A170-988CAE7C66E3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://contempothemes.com/changelog/",
      "source": "security@wordfence.com",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778",
      "source": "security@wordfence.com",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=cve",
      "source": "security@wordfence.com",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}