CVE-2024-7291: 
WordPress vulnerability analysis and mitigation

The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in versions up to and including 3.3.4.1. The vulnerability was assigned CVE-2024-7291 and was discovered by Wordfence. The issue affects WordPress installations using the JetFormBuilder plugin, particularly those configured as multi-sites (NVD Database).

The vulnerability stems from improper restriction on user meta fields in the JetFormBuilder plugin. The issue has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-269 (Improper Privilege Management) (NVD Database).

When exploited, this vulnerability allows authenticated attackers with administrator-level and above permissions to register as super-admins on WordPress sites configured as multi-sites. This could lead to unauthorized privilege elevation and potential complete site compromise (NVD Database).

Users should update their JetFormBuilder plugin to a version newer than 3.3.4.1 to address this vulnerability. The issue has been identified in the plugin's user meta property handling and register-user functionality (NVD Database).