WordPress Catch Web Tools plugin <= 2.7 - Arbitrary Catch IDs Activation/Deactivation vulnerability

Arbitrary Catch IDs Activation/Deactivation vulnerability discovered by Jan w Oleju in WordPress Catch Web Tools plugin versions = 2.7. Solution Update the WordPress Catch Web Tools plugin to the latest available version at least 2.7.1...

Catch Web Tools < 2.7.1 - Subscriber+ Arbitrary Catch IDs Activation/Deactivation

The plugin does not have authorisation and CSRF check in its catchwebtoolscatchidsswitch AJAX action, allowing any authenticated users, such as subscriber to activate/disable Catch IDs PoC fetch"https://example.com/wp-admin/admin-ajax.php", "headers": "content-type":...

WordPress Catch Web Tools plugin <= 2.6.6 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Web Tools plugin versions = 2.6.6. Solution Update the WordPress Catch Web Tools plugin to the latest available version at least 2.7...