Описание
The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.1.3 (исключая)
cpe:2.3:a:wpvibes:wp_mail_log:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 31%
0.00117
Низкий
7.6 High
CVSS3
Дефекты
CWE-863
Связанные уязвимости
CVSS3: 7.6
github
около 2 лет назад
The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
EPSS
Процентиль: 31%
0.00117
Низкий
7.6 High
CVSS3
Дефекты
CWE-863