CVE-2024-12293

The User Role Editor plugin through version 4.64.3 contains a cross-site request forgery vulnerability stemming from inadequate nonce verification in the update_roles() function. An unauthenticated attacker could exploit this flaw by crafting a malicious request that, if clicked by a site administrator, would allow the attacker to modify user roles or permissions, potentially granting themselves administrative access. The vulnerability was patched in version 4.64.4.

Based on public CVE data (MITRE/NVD).