CVE-2021-24717

The CVE-2021-24717 entry concerns the AutomatorWP WordPress plugin pre-1.7.6, where missing authorization checks allow Subscriber-role users to enumerate automations, disclose private post titles or user emails, call functions, or perform privilege escalation via Ajax actions. Root cause: lack of...

WordPress 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Plugins, which stems from The AutomatorWP WordPress plugin does no...

WordPress AutomatorWP plugin <= 1.7.5 - Missing Authorization and Privilege Escalation vulnerability

Missing Authorization and Privilege Escalation vulnerability discovered by apple502j in WordPress AutomatorWP plugin versions = 1.7.5. Solution Update the WordPress AutomatorWP plugin to the latest available version at least 1.7.6...

AutomatorWP < 1.7.6 - Missing Authorization and Privilege Escalation

The plugin does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions. Attack Procedures 1 Run this in Dashboard while logged in as Subscribe...