CVE-2024-11911

Name of the Vulnerable Software and Affected Versions WP Crowdfunding plugin for WordPress versions up to, and including, 2.1.12

Description The issue is related to a missing capability check on the install woocommerce plugin() function action, allowing authenticated attackers with Subscriber-level access and above to install WooCommerce. This has a limited impact on most sites because WooCommerce is a requirement.

Recommendations For WP Crowdfunding plugin for WordPress versions up to, and including, 2.1.12, update to a version higher than 2.1.12 to resolve the issue. As a temporary workaround, consider restricting access to the install woocommerce plugin() function to minimize the risk of exploitation.