{"id":"CVE-2024-5324","aliases":["EUVD-2024-46550","GHSA-764x-99q3-75x3"],"status":"published","title":"XootiX Framework \u003c= Various Plugin Versions - Missing Authorization to Arbitrary Options Update","description":"Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01507,"percentile":0.74565,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-862","CWE-863"],"published":"2024-06-06T02:02:48Z","modified":"2026-06-17T08:15:41Z","exploits":[{"source":"pocgithub","id":"RandomRobbieBF/CVE-2024-5324","title":"RandomRobbieBF/CVE-2024-5324","date":"2024-06-06","url":"https://github.com/RandomRobbieBF/CVE-2024-5324"}],"products":[{"vendor":"xootix","product":"login \u0026 register customizer – popup | slider | inline | woocommerce"},{"vendor":"xootix","product":"login\\/signup_popup"},{"vendor":"xootix","product":"otp login \u0026 register woocommerce"},{"vendor":"xootix","product":"otp_login_woocommerce_\\\u0026_gravity_forms"},{"vendor":"xootix","product":"side cart woocommerce | woocommerce cart"},{"vendor":"xootix","product":"side_cart_woocommerce"},{"vendor":"xootix","product":"waitlist woocommerce ( back in stock notifier )"},{"vendor":"xootix","product":"waitlist_woocommerce"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=cve","tags":["x_transferred","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83","tags":["x_transferred","Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset/3093994/","tags":["x_transferred","Patch"]},{"url":"https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83"},{"url":"https://plugins.trac.wordpress.org/changeset/3111541/"},{"url":"https://plugins.trac.wordpress.org/changeset/3115392/mobile-login-woocommerce/trunk?contextall=1\u0026old=3084918\u0026old_path=%2Fmobile-login-woocommerce%2Ftrunk"},{"url":"https://plugins.trac.wordpress.org/changeset/3117332/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5324"},{"url":"https://plugins.trac.wordpress.org/changeset/3093994"},{"url":"https://plugins.trac.wordpress.org/changeset/3111541"},{"url":"https://plugins.trac.wordpress.org/changeset/3117332"},{"url":"https://github.com/advisories/GHSA-764x-99q3-75x3"}],"sources":{"cve":[{"id":"CVE-2024-5324","title":"XootiX Framework \u003c= Various Plugin Versions - Missing Authorization to Arbitrary Options Update","description":"Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.","status":"published","published":"2024-06-06T02:02:48.411Z","modified":"2026-04-08T16:32:18.33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:01.630882Z"}],"euvd":[{"id":"EUVD-2024-46550","description":"Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.","status":"published","published":"2024-06-06T02:02:48Z","modified":"2026-04-08T16:32:18Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:12.037386Z"}],"ghsa":[{"id":"GHSA-764x-99q3-75x3","title":"The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to...","description":"The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.","status":"published","published":"2024-06-06T03:30:57Z","modified":"2026-04-08T18:34:24Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-862","CWE-863"],"updated_at":"2026-11-02T15:07:17.383381Z"}],"nvd":[{"id":"CVE-2024-5324","description":"Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.","status":"published","published":"2024-06-06T02:15:54.89Z","modified":"2026-06-17T08:15:41.82Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862","CWE-863"],"updated_at":"2026-11-02T14:10:04.111836Z"}]}}