CVE-2024-11951

Name of the Vulnerable Software and Affected Versions Homey Login Register plugin for WordPress versions up to and including 2.4.0

Description The issue allows unauthenticated attackers to gain elevated privileges by exploiting a flaw in the plugin's account registration process. This is possible because the plugin permits users to set their own role during registration, including the administrator role.

Recommendations For versions up to and including 2.4.0, update to a version that contains a fix for this issue to prevent privilege escalation.