PT-2023-32113 · WordPress · Templately
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Templately WordPress plugin versions prior to 2.2.6
Description
The issue concerns improper authorization of the
saved-templates/delete API endpoint, allowing unauthenticated users to delete arbitrary posts.Recommendations
For versions prior to 2.2.6, update to version 2.2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the
saved-templates/delete API endpoint until the update is applied.Exploit
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Templately