CVE-2024-5324

XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

8.8 HighPublic exploit

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.51%Up 1.5 points since Jun 6, 2024

What each source reports

CVE List Score used 8.8

XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

Record: CVE-2024-5324
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2024-46550 8.8

Record: EUVD-2024-46550
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-764x-99q3-75x3 8.8

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to...

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Record: GHSA-764x-99q3-75x3
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-862, CWE-863
Updated: 2026-11-02

NVD 8.8

Record: CVE-2024-5324
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-862, CWE-863
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	RandomRobbieBF/CVE-2024-5324	2024-06-06

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-5324 is a high vulnerability (CVSS 8.8) in Xootix Login & Register Customizer – Popup | Slider | Inline | Woocommerce, published June 6, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. No source names a fixed version.