CVE-2024-9519: UserPlus Privilege Escalation Vulnerability

CVE-2024-9519 Overview

CVE-2024-9519 is a privilege escalation vulnerability in the UserPlus plugin for WordPress. The flaw resides in the save_metabox_form function, which lacks a proper capability check. Authenticated attackers with editor-level access or above can modify the registration form role to administrator. Subsequent user registrations through the plugin then create administrator accounts under attacker control. The vulnerability affects UserPlus versions up to and including 2.0 and is classified under [CWE-266: Incorrect Privilege Assignment].

Critical Impact
An authenticated editor can escalate to full administrator control of the WordPress site by manipulating the registration role setting.

Affected Products

UserPlus plugin for WordPress, all versions up to and including 2.0
WordPress sites using UserPlus for user registration and role management
Multi-author WordPress deployments where editor accounts are provisioned to untrusted users

Discovery Timeline

2024-10-10 - CVE-2024-9519 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9519

Vulnerability Analysis

UserPlus stores plugin configuration, including the default role assigned by its registration form, through metabox form handlers in the WordPress admin. The save_metabox_form function processes these updates but does not verify that the calling user holds the manage_options capability. Only administrators should be permitted to alter role assignment settings.

Because the check is absent, any authenticated user meeting the plugin's minimum access threshold, including editors, can submit a crafted request that rewrites the registration role to administrator. When new users subsequently register through the plugin, WordPress assigns them administrator privileges. This grants the attacker persistent, high-privilege access without touching the underlying WordPress core.

Root Cause

The root cause is a missing authorization check in the metabox save handler. The function relies on the user being authenticated in the admin dashboard but omits a current_user_can('manage_options') gate. This maps to CWE-266, where privileges required to perform a sensitive action are lower than the action warrants.

Attack Vector

Exploitation requires network access to the WordPress admin interface and valid editor-or-above credentials. The attacker submits a POST request to the metabox handler containing modified plugin option data, including the role field set to administrator. After the change is persisted, the attacker registers a new account through the public registration form, which is then created with administrator privileges. Technical implementation details are available in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-9519

Indicators of Compromise

Unexpected changes to the UserPlus registration role setting in wp_options or plugin-specific option keys
Creation of new administrator accounts shortly after editor-level activity in the admin dashboard
POST requests to UserPlus metabox endpoints originating from non-administrator user sessions
New wp_users entries whose wp_capabilities meta value contains administrator without an audit trail

Detection Strategies

Audit the WordPress user table for administrator accounts created after October 10, 2024 on sites running UserPlus 2.0 or earlier
Compare current UserPlus plugin option values against a known-good baseline to identify role tampering
Review web server access logs for POST requests to admin-post endpoints tied to UserPlus metaboxes issued by editor accounts

Monitoring Recommendations

Enable WordPress audit logging to capture option changes and user role assignments
Alert on any modification to registration role configuration performed by non-administrator users
Track newly created administrator accounts and correlate them with recent registration events

How to Mitigate CVE-2024-9519

Immediate Actions Required

Update UserPlus to a version later than 2.0 that includes the capability check fix
Review all administrator accounts and remove any that cannot be attributed to a legitimate provisioning event
Reset credentials for editor-level accounts on affected sites and enforce multi-factor authentication
Restore the UserPlus registration role setting to its intended non-privileged value, such as subscriber

Patch Information

A fixed release of the UserPlus plugin is available through the WordPress plugin repository. Administrators should upgrade beyond version 2.0. Refer to the Wordfence Vulnerability Report for the fixed version details.

Workarounds

Deactivate the UserPlus plugin until the patched version is deployed
Restrict editor-level access to trusted staff only and audit existing editor accounts
Disable public user registration in WordPress general settings to prevent attacker-controlled account creation
Place the WordPress admin interface behind IP allowlisting or a web application firewall rule blocking metabox handler requests from non-administrator sessions

bash

# Disable public registration and audit administrators via WP-CLI
wp option update users_can_register 0
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp plugin deactivate userplus