CVE-2024-33549 HIGH

CVE-2024-33549: WordPress WZone plugin <= 14.0.10 - Privilege Escalation vulnerability

Vendor Aa-Team
Product WZone
Weakness CWE-269
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in AA-Team WZone allows Privilege Escalation.This issue affects WZone: from n/a through 14.0.10.

Explanation of Vulnerability in Simple Terms

02Summary

WZone versions up to 14.0.10 contain a privilege management flaw that allows authenticated users with low-level access to read sensitive data, modify site content, or disrupt service. An attacker needs a valid user account but no special permissions to exploit this vulnerability. Sites running affected versions should update immediately.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify content, or disrupt service availability on the site.

Potential impact on your site

04Site Impact

Any authenticated user can access or modify data and functionality they should not have permission to use.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges; no user interaction required.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-8899 Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.20 - Authenticated (Author+) Privilege Escalation CVE-2026-0912 Toret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions CVE-2025-8572 Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration CVE-2026-15982 Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function' CVE-2026-6419 Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action