PT-2025-51067 · WordPress · Easy Theme Options
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Easy Theme Options plugin for WordPress versions prior to 1.1
Description
The Easy Theme Options plugin for WordPress is affected by a missing authorization issue. Attackers with Subscriber-level access or higher can import arbitrary plugin settings through the
eto import settings parameter. This is due to a lack of authorization checks within the eto import settings() function.Recommendations
Update the Easy Theme Options plugin to version 1.1 or later.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Easy Theme Options