How severe is CVE-2024-11281?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2024-11281?

This is classified as CWE-862, which is a common weakness in software security.

CVE-2024-11281 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0. This is due to insufficient validation on the 'logged_in_user_id' value when option values are empty and the ability for attackers to change the email of arbitrary user accounts. This makes it possible for unauthenticated attackers to change the email of arbitrary user accounts, including administrators, and reset their password to gain access to the account.

Related Vulnerabilities

CVE-2011-4183

CRITICAL

CVSS:9.8(Critical)

A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.

CWE-8622011

CVE-2016-11036

CRITICAL

CVSS:9.8(Critical)

An issue was discovered on Samsung mobile devices with M(6.0) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2016-6008 (August 2016).

CWE-8622016

CVE-2017-1000056

CRITICAL

CVSS:9.8(Critical)

Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.

CWE-8622017

CVE-2017-12582

CRITICAL

CVSS:9.8(Critical)

Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user cannot login at front end but with that un...

CWE-8622017

CVE-2017-9232

CRITICAL

CVSS:9.8(Critical)

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

CWE-8622017

CVE-2018-10251

CRITICAL

CVSS:9.8(Critical)

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could all...

CWE-8622018