CVE-2022-4004 Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam

2022-12-1217:54:42

WPScan

www.cve.org

wordpress

plugin

sms spam

broken access control

twilio integration

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its “donation_button_twilio_send_test_sms” AJAX action, which may allow any users with an account on the affected site, like subscribers, to use the plugin’s Twilio integration to send SMSes to arbitrary phone numbers.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Donation Button",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "4.0.0"
      }
    ],
    "defaultStatus": "affected"
  }
]