Описание
The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.1.3 (исключая)
cpe:2.3:a:wpvibes:wp_mail_log:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 41%
0.00499
Низкий
7.6 High
CVSS3
Дефекты
CWE-863
Связанные уязвимости
CVSS3: 7.6
github
больше 2 лет назад
The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
EPSS
Процентиль: 41%
0.00499
Низкий
7.6 High
CVSS3
Дефекты
CWE-863