Описание
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.
EPSS
Процентиль: 8%
0.00181
Низкий
5.4 Medium
CVSS3
Дефекты
CWE-284
Связанные уязвимости
CVSS3: 5.4
github
8 дней назад
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.
EPSS
Процентиль: 8%
0.00181
Низкий
5.4 Medium
CVSS3
Дефекты
CWE-284