PT-2022-9570 · WordPress · Qubely

Name of the Vulnerable Software and Affected Versions: Qubely WordPress plugin versions prior to 1.7.8 Description: The issue concerns a lack of authorization and CSRF check on the "qubely delete saved block" AJAX action. This allows any authenticated user, such as a subscriber, to delete arbitra...

Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion

The plugin does not have authorisation and CSRF check on the qubelydeletesavedblock AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts Note: v1.7.7 added capability check, CSRF che...

Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion

The plugin does not have authorisation and CSRF check on the qubelydeletesavedblock AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts Note: v1.7.7 added capability check, CSRF che...

WordPress Qubely – Advanced Gutenberg Blocks plugin <= 1.7.7 - Authenticated Post Deletion vulnerability

Authenticated Post Deletion vulnerability discovered by Krzysztof Zając in WordPress Qubely – Advanced Gutenberg Blocks plugin versions = 1.7.7. Solution Update the WordPress Qubely – Advanced Gutenberg Blocks plugin to the latest available version at least 1.7.8...