PT-2026-1009 · WordPress · My Sticky Elements
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
My Sticky Elements plugin for WordPress versions prior to 2.3.4
Description
The My Sticky Elements plugin for WordPress is susceptible to unauthorized data loss. A missing capability check within the
my sticky elements bulks function allows authenticated attackers with Subscriber-level access or higher to delete all contact form leads stored by the plugin.Recommendations
Update to version 2.3.4 or later.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
My Sticky Elements