CVE-2024-33569 HIGH

CVE-2024-33569: WordPress Instant Images plugin <= 6.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability

Vendor Darren Cooney
Product Instant Images
Weakness CWE-269
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in Darren Cooney Instant Images allows Privilege Escalation.This issue affects Instant Images: from n/a through 6.1.0.

Explanation of Vulnerability in Simple Terms

02Summary

Instant Images versions up to 6.1.0 contain a privilege management flaw that allows high-privileged users to perform unauthorized actions. An authenticated administrator can read sensitive data, modify site content, or disrupt service. The vulnerability requires admin-level access to exploit and does not affect the confidentiality or integrity of data outside the admin scope.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify content, or disrupt service if they have admin-level access.

Potential impact on your site

04Site Impact

Admins with compromised credentials could abuse their role beyond intended scope; restrict admin access.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative privileges on the site.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-5144 BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR CVE-2025-13851 Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration CVE-2026-9842 Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities CVE-2026-7465 Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes CVE-2025-12981 Listee <= 1.1.6 - Unauthenticated Privilege Escalation