PT-2026-104086 · WordPress · Popup Maker
CVSS v3.1
4.3
متوسطة
| المتجه | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Popup Maker WordPress plugin versions prior to 1.4.6
Description
The plugin fails to perform a capability check on an account-connection action, relying solely on nonce verification. This allows authenticated users with minimal privileges, such as Subscribers, to overwrite site-wide configuration options, including the linked service account and API configuration, which should be restricted to administrators.
Recommendations
Update the plugin to version 1.4.6 or later.
استغلال
إصلاح
Improper Access Control
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Popup Maker