What’s Vulnerable › Vulnerabilities

CVE-2024-5324: XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-06 · updated 2026-06-17
• Weakness: CWE-862

Description

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Affected products

• xootix Login & Register Customizer – Popup | Slider | Inline | WooCommerce: 2.7.1, 2.7.2
• xootix OTP Login & Register Woocommerce: before 2.6.2 — fixed in 2.6.2
• XootiX Side Cart Woocommerce (Ajax): 2.5
• xootix Waitlist Woocommerce ( Back in stock notifier ): before 2.6.1 — fixed in 2.6.1

How to fix

Upgrade to a fixed version: xootix OTP Login & Register Woocommerce 2.6.2; xootix Waitlist Woocommerce ( Back in stock notifier ) 2.6.1. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83
• https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83
• https://plugins.trac.wordpress.org/changeset/3093994/
• https://plugins.trac.wordpress.org/changeset/3111541/
• https://plugins.trac.wordpress.org/changeset/3115392/mobile-login-woocommerce/trunk?contextall=1&old=3084918&old_path=%2Fmobile-login-woocommerce%2Ftrunk
• https://plugins.trac.wordpress.org/changeset/3117332/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=cve
• https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83
• https://plugins.trac.wordpress.org/changeset/3093994/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=cve

Get alerted when CVE-2024-5324 or the next vulnerability affects your stack