CVE-2024-56280
Published: 07 January 2025
Summary
CVE-2024-56280 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 48.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces least privilege to directly prevent privilege escalation from incorrect privilege assignment in the WPGuppy plugin.
Mandates timely flaw remediation, such as patching the WPGuppy plugin to fix the privilege escalation vulnerability.
Requires enforcement of approved authorizations, mitigating unauthorized privilege escalations attempted via the plugin flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping to privilege escalation via incorrect privilege assignment in authenticated context.
NVD Description
Incorrect Privilege Assignment vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Privilege Escalation.This issue affects WPGuppy: from n/a through <= 1.1.0.
Deeper analysisAI
CVE-2024-56280 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the WPGuppy lite WordPress plugin from AmentoTech Private Limited. The flaw enables privilege escalation and affects all versions of WPGuppy from n/a through 1.1.0.
With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited by an authenticated attacker possessing low privileges over the network. Exploitation requires low complexity and no user interaction, allowing the attacker to escalate privileges and achieve high impacts on confidentiality, integrity, and availability.
Mitigation details are provided in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpguppy-lite/vulnerability/wordpress-wpguppy-plugin-1-1-0-privilege-escalation-vulnerability?_s_id=cve.
Details
- CWE(s)