{"id":"CVE-2024-9192","aliases":["EUVD-2024-50280","GHSA-f3hj-px43-qpfm"],"status":"published","title":"WP Video Robot \u003c= 1.20.0 -  Authenticated (Subscriber+) Privilege Escalation via User Meta Update","description":"The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due to insufficient validation on user meta that can be updated in the wpvr_rate_request_result() function in all versions up to, and including, 1.20.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta on a WordPress site. This can be leveraged to update their capabilities to that of an administrator.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00582,"percentile":0.4808,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2024-11-16T03:20:44Z","modified":"2026-06-17T08:24:06Z","products":[{"vendor":"pressaholic","product":"wordpress video robot - the ultimate video importer"},{"vendor":"pressaholic","product":"wordpress_video_robot"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da019d3-4aca-485a-aa0c-73728dc1e7c1?source=cve"},{"url":"https://codecanyon.net/item/wordpress-video-robot-plugin/8619739"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9192"},{"url":"https://github.com/advisories/GHSA-f3hj-px43-qpfm"}],"sources":{"cve":[{"id":"CVE-2024-9192","title":"WP Video Robot \u003c= 1.20.0 -  Authenticated (Subscriber+) Privilege Escalation via User Meta Update","description":"The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due to insufficient validation on user meta that can be updated in the wpvr_rate_request_result() function in all versions up to, and including, 1.20.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta on a WordPress site. This can be leveraged to update their capabilities to that of an administrator.","status":"published","published":"2024-11-16T03:20:44.515Z","modified":"2026-04-08T16:44:14.14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:34:06.48311Z"}],"euvd":[{"id":"EUVD-2024-50280","description":"The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due to insufficient validation on user meta that can be updated in the wpvr_rate_request_result() function in all versions up to, and including, 1.20.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta on a WordPress site. This can be leveraged to update their capabilities to that of an administrator.","status":"published","published":"2024-11-16T03:20:44Z","modified":"2026-04-08T16:44:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:04.728681Z"}],"ghsa":[{"id":"GHSA-f3hj-px43-qpfm","title":"The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to...","description":"The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due to insufficient validation on user meta that can be updated in the wpvr_rate_request_result() function in all versions up to, and including, 1.20.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta on a WordPress site. This can be leveraged to update their capabilities to that of an administrator.","status":"published","published":"2024-11-16T06:30:41Z","modified":"2024-11-16T06:30:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:58:51.906051Z"}],"nvd":[{"id":"CVE-2024-9192","description":"The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due to insufficient validation on user meta that can be updated in the wpvr_rate_request_result() function in all versions up to, and including, 1.20.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta on a WordPress site. This can be leveraged to update their capabilities to that of an administrator.","status":"published","published":"2024-11-16T04:15:06.813Z","modified":"2026-06-17T08:24:06.85Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:10:37.281254Z"}]}}