https://vulnerability.circl.lu/sightings/feed 2026-06-04T10:50:53.697590+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/83ebff34-73af-4372-92b4-59e0d81c5090/export 2026-06-04T10:50:54.181467+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "83ebff34-73af-4372-92b4-59e0d81c5090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8485", "type": "seen", "source": "https://t.me/cvedetector/6271", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2024-8485 - \"WordPress MiniProgram Plugin Remote Unauthenticated Privilege Escalation Vulnerability\"\", \n \"Content\": \"CVE ID : CVE-2024-8485 \nPublished : Sept. 25, 2024, 3:15 a.m. | 34\u00a0minutes ago \nDescription : The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it possible for unauthenticated attackers to update arbitrary user's accounts, including their email to a @weixin.com email, which can the be leveraged to reset the password of the user's account, including administrators. \nSeverity: 9.8 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"25 Sep 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-25T05:57:17.000000Z"} 2024-09-25T05:57:17+00:00