CVE-2024-8349 Overview
The Uncanny Groups for LearnDash plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 6.1.0.1. The plugin fails to properly restrict which user accounts a group leader can modify. Authenticated attackers with group leader privileges or higher can change the email address of administrator accounts. Once the admin email is changed, attackers trigger a password reset to that address and take over the administrator account. This missing authorization flaw is tracked as [CWE-862] and affects installations that rely on the plugin's group leader role for managing LearnDash learner groups.
Critical Impact
Group leaders can hijack administrator accounts on affected WordPress sites, leading to full site compromise.
Affected Products
- Uncanny Owl Uncanny Groups for LearnDash plugin for WordPress
- All versions up to and including 6.1.0.1
- WordPress sites using LearnDash learning management with the Uncanny Groups add-on
Discovery Timeline
- 2024-09-25 - CVE-2024-8349 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8349
Vulnerability Analysis
The vulnerability is a missing authorization flaw in the user edit workflow exposed to group leaders. The plugin allows group leaders to manage users belonging to their group, including editing profile fields such as the email address. However, it does not verify that the user targeted by an edit request is actually a member of the calling group leader's group, nor that the target is not an administrator. A group leader can supply an arbitrary user ID belonging to an administrator and change that administrator's email address. With control of the admin email, the attacker requests a password reset through the standard WordPress wp-login.php?action=lostpassword flow and receives the reset link at an attacker-controlled inbox. The result is full takeover of the WordPress administrator account and, by extension, the site.
Root Cause
The plugin trusts the group leader role for user modification requests without enforcing an authorization check on the target user. There is no verification that the target user_id is within the leader's assigned group and no role-based restriction preventing edits against users holding the administrator capability. This meets the definition of [CWE-862] Missing Authorization.
Attack Vector
Exploitation requires an authenticated account with group leader privileges. The attacker submits a crafted user-edit request through the plugin's group management interface, referencing an administrator's user ID and supplying a new email address. After the email is overwritten, the attacker initiates a WordPress password reset for the administrator account and completes account takeover through the reset link sent to the attacker's inbox. Technical details and a proof of concept are documented in the public PoC repository and the Wordfence vulnerability report.
Detection Methods for CVE-2024-8349
Indicators of Compromise
- Unexpected changes to the user_email value of administrator accounts in the wp_users table.
- Password reset emails for administrator accounts delivered to addresses that do not belong to legitimate admins.
- Successful administrator logins from IP addresses previously associated only with group leader accounts.
- Recent plugin, theme, or user role modifications performed immediately after an administrator email change.
Detection Strategies
- Audit the WordPress user database for administrator email addresses on external or free webmail domains that do not match provisioned admin identities.
- Correlate group leader session activity with subsequent administrator password reset events in mail and web server logs.
- Query the plugin's installed version and flag any host running Uncanny Groups for LearnDash 6.1.0.1 or earlier.
Monitoring Recommendations
- Enable a WordPress audit logging solution that records profile field changes, role assignments, and password reset requests.
- Alert on any modification to the email address of an account holding the administrator role, regardless of the calling user.
- Monitor wp-login.php?action=lostpassword and resetpass requests targeting administrator usernames.
How to Mitigate CVE-2024-8349
Immediate Actions Required
- Update the Uncanny Groups for LearnDash plugin to a version later than 6.1.0.1 as soon as the vendor patch is available.
- Review every WordPress administrator account and confirm the associated email address is correct and controlled by the legitimate owner.
- Rotate passwords and revoke active sessions for all administrator accounts on affected sites.
- Audit the group leader user population and remove group leader privileges from any account that does not require them.
Patch Information
Refer to the Wordfence vulnerability report for the fixed version and vendor guidance. Apply the update through the WordPress plugin manager or by replacing the plugin files with the patched release from Uncanny Owl. Confirm the plugin version in the WordPress admin plugins screen after updating.
Workarounds
- Temporarily disable the Uncanny Groups for LearnDash plugin on sites where an immediate update is not possible.
- Restrict the group leader role to trusted internal staff only until patching is complete.
- Enforce multi-factor authentication for all administrator accounts so a stolen password reset link alone cannot complete account takeover.
- Configure a Web Application Firewall rule to block requests to the plugin's group management endpoints originating from non-administrative accounts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
