CVE-2024-8420
The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on sites.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - security@wordfence.com
- Published
- 2025-02-28
- Last modified
- 2026-04-08
- Weaknesses
- CWE-266, CWE-269
Affected products
References
- https://codecanyon.net/item/dhvc-form-wordpress-form-for-visual-composer/8326593
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d51a0c-c625-4732-b345-df02971fbffa?source=cve
