CVE-2024-37484: 
WordPress vulnerability analysis and mitigation

The Zephyr Project Manager WordPress plugin contains a privilege escalation vulnerability (CVE-2024-37484) affecting all versions up to and including 3.3.97. The vulnerability was discovered on July 4, 2024, and stems from improper privilege management in the plugin's user meta update functionality (WPScan, Patchstack).

The vulnerability is caused by insufficient verification of user meta updates through the updateusermeta function. The issue has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-269 (Improper Privilege Management) (NVD).

This vulnerability allows authenticated attackers with subscriber-level access or higher to update their user meta, which can be exploited to elevate their privileges to administrator level. This could potentially give attackers full control over the affected WordPress installation (WPScan).

Website administrators are advised to update the Zephyr Project Manager plugin to version 3.3.99 or later, which contains the fix for this vulnerability (Patchstack).