CVE-2021-24779

Vulnerability summary: The WP Debugging WordPress plugin (versions before 2.11.0) is affected by an unauthenticated settings update flaw. The update_settings() function is hooked to admin_init and lacks authorization and CSRF checks, allowing unauthenticated users to modify plugin settings. Affec...

WordPress JobSearch premium plugin <= 1.8.1 - Unauthenticated Settings Change vulnerability

Unauthenticated Settings Change vulnerability discovered by Jerome Bruandet NinTechNet in WordPress JobSearch premium plugin versions = 1.8.1. Solution Update the WordPress JobSearch premium plugin to the latest available version at least 1.8.2...

WooCommerce Dynamic Pricing & Discounts < 2.4.2 - Unauthenticated Settings Export

The plugin does not have authorisation check on its export feature, allowing unauthenticated users to export them. PoC https://example.com/?rpwcdpdexportsettings=1...

WordPress WooCommerce Dynamic Pricing & Discounts premium plugin <= 2.4.1 - Unauthenticated Settings Export vulnerability

Unauthenticated Settings Export vulnerability discovered by Jerome Bruandet NinTechNet in WordPress WooCommerce Dynamic Pricing & Discounts premium plugin versions = 2.4.1. Solution Update the WordPress WooCommerce Dynamic Pricing & Discounts premium plugin to the latest available version at leas...

CVE-2020-20627

The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change...

CVE-2020-20627

The GiveWP plugin for WordPress, in versions through 2.5.9 , is vulnerable to an unauthenticated settings change . The root cause is insecure access within the includes/gateways/stripe/includes/admin/admin-actions.php file, which allows an attacker to modify plugin settings without any authentica...

CVE-2019-15820

The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmisavesettings authentication...

Ocean Extra <= 1.5.8 - Unauthenticated Settings change and CSS injection

The Ocean Extra WordPress plugin was affected by an Unauthenticated Settings change and CSS injection security vulnerability...

CVE-2018-11579

class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wpajaxnopriv usage. Anyone can change the plugin's setting by simply sending a request with a...

CVE-2018-11579: Improper Authentication

class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wpajaxnopriv usage. Anyone can change the plugin's setting by simply sending a request with a...