CVE-2024-7624 Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation

What is CVE-2024-7624?

CVE-2024-7624 is a high-severity vulnerability in dylanjkotze Zephyr Project Manager, published on 15 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_access() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings.

Weakness: CWE-863, CWE-285

Which versions are affected by CVE-2024-7624?

It affects 1 product.

Products include Zephyr-One Zephyr Project Manager.

How do I fix CVE-2024-7624?

No fix has been published for CVE-2024-7624 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-7624 being exploited?

There is no known exploitation of CVE-2024-7624 in the wild and no public exploit code.

Other vulnerabilities in dylanjkotze Zephyr Project Manager

• CVE-2022-2840 Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi Critical 9.8
• CVE-2024-37484 WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability High 8.8
• CVE-2024-38761 WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability High 7.5
• CVE-2025-32526 WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2024-7356 Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c9xj-qgpm-mj78.