CVE-2024-9195 – WHMPress - WHMCS Client Area <= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Update

https://notcve.org/view.php?id=CVE-2024-9195

27 Feb 2025 — The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the update_settings case in the /admin/ajax.php file in all versions up to, and including, 4.3-revision-3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator... • https://codecanyon.net/item/whmcs-client-area-whmpress-addon/11218646 • CWE-862: Missing Authorization •