CVE-2024-33550 HIGH

CVE-2024-33550: WordPress WP Masquerade plugin <= 1.1.0 - Authenticated Account Takeover vulnerability

Vendor Jr King/Eran Schoellhorn
Product WP Masquerade
Weakness CWE-269
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in JR King/Eran Schoellhorn WP Masquerade allows Privilege Escalation.This issue affects WP Masquerade: from n/a through 1.1.0.

Explanation of Vulnerability in Simple Terms

02Summary

WP Masquerade versions up to 1.1.0 contain a privilege management flaw that allows authenticated users with low privileges to gain unauthorized access to sensitive data and modify site content. An attacker with a basic user account can read confidential information, alter posts or settings, and potentially disrupt site availability. No user interaction is required beyond initial authentication.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify site content, and disrupt availability with a low-privilege user account.

Potential impact on your site

04Site Impact

Compromised user accounts can access and modify protected content, risking data exposure and site integrity.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege user account on the site.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-6419 Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action CVE-2026-12165 Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter CVE-2026-5118 Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role' CVE-2026-14262 Simple JWT Login <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter CVE-2026-12736 WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint