PT-2023-11858 · WordPress · Wp Activity Log
CVSS v3.1
7.3
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
WP Activity Log plugin for WordPress versions up to, and including, 4.0.1
Description
The issue is related to authorization bypass due to a missing capability check on the
setup page function. This allows unauthenticated attackers to run the setup wizard and access plugin configuration options if the setup wizard has not been run previously.Recommendations
For WP Activity Log plugin for WordPress versions up to, and including, 4.0.1, update to a version higher than 4.0.1 to resolve the issue.
Exploit
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wp Activity Log