CVE-2024-22157CWE-269

WordPress SalesKing plugin <= 1.6.15 - Unauthenticated Privilege Escalation vulnerability

Critical · published May 17, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

🚨 A privilege escalation vulnerability in WebWizards SalesKing could let attackers take over with ease! 🔥 Think of it like a hotel where anyone can stroll into the penthouse suite without a keycard, leaving your valuables wide open for the taking. This vulnerability lets unauthorized users elevate their access to sensitive areas of the system, just like giving someone the master key to your entire building! An attacker could exploit this flaw to gain elevated privileges, potentially allowing them to alter configurations, access confidential data, or even manipulate user accounts. This could lead to absolute chaos within your systems, risking both data integrity and user trust. Yikes!

Put simply

Think of it like a hotel where anyone can stroll into the penthouse suite without a keycard, leaving your valuables wide open for the taking. This vulnerability lets unauthorized users elevate their access to sensitive areas of the system, just like giving someone the master key to your entire building! The improper privilege management vulnerability in WebWizards SalesKing allows unauthorized users to escalate their privileges beyond intended limits, affecting versions up to 1.6.15, and enabling them to perform actions that should be restricted.

What to do

An attacker could exploit this flaw to gain elevated privileges, potentially allowing them to alter configurations, access confidential data, or even manipulate user accounts. This could lead to absolute chaos within your systems, risking both data integrity and user trust. Yikes! Immediately update SalesKing to version 1.6.16 or later to close this critical gap. Additionally, review user access roles and permissions to ensure they are appropriately assigned and monitor system logs for any suspicious activity. Don't wait on this one! You've got this! By taking swift action, you'll fortify your defenses and keep those digital keycards safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00585 · 47.2th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-05-17T08:47Z
EPSS history
Timeline
  • 17 MAY 08:47Z
    WordPress SalesKing plugin <= 1.6.15 - Unauthenticated Privilege Escalation vulnerability
    cvelistv5