PT-2023-12454 · WordPress · Ulisting
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
uListing plugin for WordPress versions up to, and including, 1.6.6
Description
The issue is related to authorization bypass due to missing capability and nonce checks on the
UlistingUserRole::save role api method. This allows unauthenticated attackers to remove or add roles and add capabilities.Recommendations
For versions up to, and including, 1.6.6, update to a version that includes the necessary capability and nonce checks to prevent authorization bypass.
Exploit
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ulisting