Описание
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
EPSS
Процентиль: 16%
0.00245
Низкий
7.5 High
CVSS3
Дефекты
CWE-200
Связанные уязвимости
CVSS3: 7.5
github
около 1 месяца назад
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
EPSS
Процентиль: 16%
0.00245
Низкий
7.5 High
CVSS3
Дефекты
CWE-200