PT-2026-90583 · Undefined · Undefined
CVSS v3.1
4.3
متوسطة
| المتجه | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Sprout Invoices WordPress plugin versions prior to 20.8.16
Description
An issue exists where the software fails to perform capability or ownership checks before allowing a private note to be overwritten via an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to overwrite private notes on records belonging to other users through the
si edit private note action.Recommendations
Update the Sprout Invoices WordPress plugin to version 20.8.16 or later.
استغلال
إصلاح
Missing Authorization
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Undefined