CWE-266
AllowedIncorrect Privilege Assignment
Abstraction: Base · Status: Draft
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
1921 vulnerabilities reference this CWE, most recent first.
GHSA-XW8C-XM8R-XHHF
Vulnerability from github – Published: 2024-06-04 03:30 – Updated: 2026-04-08 21:32The Frontend Registration – Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient restriction on the 'cf7frr' post meta. This makes it possible for authenticated attackers, with editor-level access and above, to modify the default user role in the registration form settings.
{
"affected": [],
"aliases": [
"CVE-2024-4870"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-04T02:15:49Z",
"severity": "HIGH"
},
"details": "The Frontend Registration \u2013 Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient restriction on the \u0027_cf7frr_\u0027 post meta. This makes it possible for authenticated attackers, with editor-level access and above, to modify the default user role in the registration form settings.",
"id": "GHSA-xw8c-xm8r-xhhf",
"modified": "2026-04-08T21:32:42Z",
"published": "2024-06-04T03:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4870"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/frontend-registration-contact-form-7/trunk/frontend-registration-cf7.php?rev=2975770#L244"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca616ae6-59d3-4037-b538-d371f007a037?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.