CVE-2024-7624: Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation
Vulnerability summary
CVE-2024-7624 is a high (CVSS 8.1) Incorrect Authorization vulnerability in dylanjkotze zephyr_project_manager. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.2% of scored vulnerabilities.
Timeline
- 15-08-2024PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_access() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- wordfenceSource8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.40% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Dylanjkotze1 product
- zephyr_project_manager≤ 3.3.101
Wordpress1 product
- zephyr-project-manager≤ 3.3.101 (fixed in 3.3.102)
Zephyr-one1 product
- zephyr_project_manager< 3.3.102
3 vendors · 3 products