CVE-2024-12172
Published: 12 December 2024
Summary
CVE-2024-12172 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 6.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The WP Courses LMS plugin for WordPress, in all versions through 3.2.21, contains a missing capability check in the wpc_update_user_meta_option() function. This flaw is tracked as CVE-2024-12172 and carries a CVSS 3.1 base score of 7.5. The issue permits any authenticated user to modify arbitrary user metadata entries stored by WordPress.
An attacker with Subscriber-level access or higher can invoke the unprotected function to overwrite metadata such as wp_capabilities for any user account. Setting this value to 0 removes all roles from the target, which can be used to lock administrators out of the site while leaving the attacker’s own account intact.
The referenced Wordfence advisory and the linked plugin changeset indicate that the vendor addressed the missing authorization check in a subsequent release. Site owners are advised to update the plugin to the newest available version and to review user capabilities for unexpected changes.
EPSS for the CVE has remained in the 0.11–0.13 range with only modest movement between current and peak values.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50647
Vulnerability details
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21.…
more
This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.