CVE-2024-3668: 
WordPress vulnerability analysis and mitigation

The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 2.10.17. The vulnerability was discovered and disclosed on June 8, 2024. This security issue affects WordPress installations using the PowerPack Pro for Elementor plugin (NVD).

The vulnerability stems from the plugin's failure to restrict low privileged users from setting a default role for a registration form. This security flaw allows authenticated attackers with contributor-level access or higher to create a registration form with administrator set as the default role and subsequently register as an administrator. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 HIGH with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The impact of this vulnerability is severe as it allows privilege escalation to administrator level. Successful exploitation would give attackers full administrative access to the WordPress site, enabling them to modify site content, install or remove plugins and themes, manage users, and potentially gain access to sensitive information (NVD).

The vulnerability is exploitable by authenticated users with contributor-level access or higher. The attack requires low complexity and no user interaction, making it relatively straightforward to exploit. The attacker needs only basic privileges to create a registration form and can then escalate their privileges to administrator level (NVD).

The vulnerability has been patched in version 2.10.18 of the PowerPack Pro for Elementor plugin. Site administrators should update to this version or later to protect against this security issue (PowerPack Changelog).