CVE-2024-51888
Published: 21 January 2025
Summary
CVE-2024-51888 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 44.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-2 (Account Management).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of identified flaws, directly addressing the privilege escalation vulnerability by patching the Homey Login Register plugin to versions beyond 2.4.0.
Enforces least privilege to restrict access rights, countering the incorrect privilege assignment that enables unauthenticated escalation.
Manages accounts and privileges to ensure only authorized assignments, mitigating risks from flawed plugin logic granting elevated access.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote privilege escalation via incorrect privilege assignment in public-facing WordPress plugin enables T1190 (initial access via public app exploit) and T1068 (exploitation for privilege escalation).
NVD Description
Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login Register: from n/a through <= 2.4.0.
Deeper analysisAI
CVE-2024-51888 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Homey Login Register WordPress plugin developed by favethemes. The flaw enables privilege escalation and affects all versions of the plugin from its initial release through 2.4.0.
With a CVSS v3.1 base score of 9.8 (Critical), the vulnerability is exploitable over the network (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). Unauthenticated remote attackers can leverage this issue to escalate their privileges within affected WordPress installations.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/homey-login-register/vulnerability/wordpress-homey-login-register-plugin-2-4-0-privilege-escalation-vulnerability?_s_id=cve provides details on the vulnerability, recommending updates to patched versions of the Homey Login Register plugin beyond 2.4.0 as the primary mitigation.
Details
- CWE(s)