CVE-2024-21743 HIGH

CVE-2024-21743: WordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerability

Vendor Favethemes

Product Houzez Login Register

Weakness CWE-266

Published September 17, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5.

Explanation of Vulnerability in Simple Terms

02Summary

Houzez Login Register versions up to 3.2.5 contain an improper privilege escalation vulnerability. An authenticated user with low privileges can gain high-level access to the site, including the ability to read sensitive data, modify content, and disrupt service. The vulnerability requires only network access and no user interaction from the victim.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify site content, and disrupt service availability after gaining elevated privileges.

Potential impact on your site

04Site Impact

Any registered user can escalate their account to administrator-level access, compromising site security and data integrity.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

September 17, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-21743 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/266.html AskarLabs — CWE-266 write-up Incorrect Privilege Assignment

Related vulnerabilities