What is the CVSS score of CVE-2024-50475?

CVE-2024-50475 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 32.0%.

Which versions of Signup Page plugin are affected by CVE-2024-50475?

The Signup Page WordPress plugin (all versions up to 1.0) contains a critical privilege escalation vulnerability enabling attackers to seize administrative control of affected websites.

How to fix or mitigate CVE-2024-50475?

Within 24 hours: Identify all WordPress installations using the Signup Page plugin; immediately disable and remove the plugin; audit all administrator accounts for unauthorized modifications; reset passwords for all administrative users. Within 7 days: Deploy an alternative user registration solution from a security-vetted provider; review access logs and administrative activity on affected systems for compromise indicators; restore from clean backups if unauthorized access is confirmed. Within 30 days: Establish a plugin governance policy requiring security assessment prior to installation; configure Web Application Firewall (WAF) rules to detect and block privilege escalation attempts; implement comprehensive logging and alerting for administrative account changes.

Signup Page plugin CVE-2024-50475

CRITICAL

Missing Authorization (CWE-862)

2024-10-29 audit@patchstack.com

WordPress Authentication Bypass Privilege Escalation Wordpress Plugin

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:22 NVD

9.8 (CRITICAL)

CVE Published

Oct 29, 2024 - 09:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in Scott Gamon Signup Page signup-page allows Privilege Escalation.This issue affects Signup Page: from n/a through <= 1.0.

AnalysisAI

Privilege escalation in Scott Gamon's Signup Page WordPress plugin (versions up to and including 1.0) allows remote unauthenticated attackers to elevate privileges due to a missing authorization check (CWE-862). With a CVSS score of 9.8 and an EPSS score of 31.97% (97th percentile), this represents an elevated exploitation likelihood, though no public exploit is identified at time of analysis.

Technical ContextAI

The Signup Page plugin is a WordPress extension developed by Scott Gamon that handles user signup functionality. The root cause is CWE-862 (Missing Authorization), where the application fails to perform an authorization check before granting access to a sensitive function or resource. In the context of a signup/registration plugin, this typically means privileged actions (such as setting user roles or capabilities during registration) are exposed without proper capability checks via WordPress's current_user_can() or nonce verification mechanisms, allowing attackers to bypass the intended privilege model.

Affected ProductsAI

Scott Gamon Signup Page plugin for WordPress, all versions from n/a through and including 1.0 are affected. No CPE string was provided in the available data. The vendor advisory was not provided in references, but Patchstack typically publishes details at patchstack.com given audit@patchstack.com is the CNA for this CVE.

RemediationAI

No vendor-released patch identified at time of analysis - version 1.0 is the latest affected version with no fixed version disclosed in the available data. As a primary compensating control, deactivate and uninstall the Signup Page plugin until a patched release is published, since the affected functionality is the plugin's core purpose and partial mitigation is not feasible. If the plugin must remain active, restrict access to the WordPress registration endpoints via web application firewall rules (Patchstack, Wordfence, or equivalent virtual patching) and disable open user registration in WordPress Settings > General by unchecking 'Anyone can register,' though this may not block the vulnerable codepath if it bypasses standard registration. Monitor the Patchstack advisory database and the plugin's repository page on wordpress.org for a fixed version release.