CVE-2024-11443 is a missing authorization vulnerability (CWE-862) in the de:branding WordPress plugin affecting all versions up to 1.0.2. The vulnerability arises because the debranding_save() function lacks proper capability checks, allowing authenticated users with low privileges (subscriber and above) to update arbitrary WordPress options. This can be exploited to escalate privileges by changing the default registration role to administrator and enabling user registration, thereby allowing attackers to create admin accounts on the affected site. The vulnerability is remotely exploitable over the network without user interaction and has a high impact on confidentiality, integrity, and availability (CVSS 8.8). No patch or official remediation has been documented in the provided information.

Successful exploitation allows an authenticated low-privilege user to escalate their privileges to administrator by modifying site options, including the default user role and registration settings. This leads to full administrative control over the WordPress site, compromising confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 8.8, indicating a critical risk to affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and consider disabling or removing the de:branding plugin if possible. Monitor for updates from the vendor or plugin maintainers and apply patches promptly once released.