CVE-2024-12296

CVE-2024-12296 is a privilege escalation vulnerability affecting the Apus Framework plugin for WordPress, specifically versions up to and including 2.3. It allows authenticated attackers, even with Subscriber-level access, to modify arbitrary WordPress options due to a missing capability check. This can be exploited to change the default user registration role to administrator, enabling attackers to gain full administrative control over the site. The vulnerability has a CVSS score of 8.8 (High) due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules or significant community discussion surrounding this CVE.