CVE-2024-43333
Published: 03 February 2025
Summary
CVE-2024-43333 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 16.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2024-43333 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the NotFound Admin and Site Enhancements (ASE) Pro WordPress plugin, enabling privilege escalation. The issue affects all versions of the plugin from its initial release through 7.6.2.1. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility but high attack complexity.
A low-privileged authenticated user can exploit this vulnerability remotely without user interaction. Successful exploitation allows the attacker to escalate privileges, potentially gaining unauthorized high-level access such as administrator rights on the affected WordPress site, with high impacts on confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-plugin-7-6-2-1-privilege-escalation-vulnerability?_s_id=cve documents this privilege escalation vulnerability in ASE Pro versions through 7.6.2.1, recommending updates to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40296
Vulnerability details
Incorrect Privilege Assignment vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Privilege Escalation. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.2.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation vulnerability in public-facing WordPress plugin allows low-privileged authenticated users to gain admin rights via exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of flaws in vulnerable software like ASE Pro plugin versions through 7.6.2.1, directly preventing privilege escalation exploitation.
Enforces least privilege principle to restrict low-privileged users from escalating to administrator rights via incorrect privilege assignment in the plugin.
Mandates enforcement mechanisms that approve and restrict access based on assigned privileges, countering the plugin's improper privilege assignment vulnerability.