CVE-2024-5570 Simple Photoswipe <= 0.1 - Subscriber+ Arbitrary Settings Update

2024-06-2806:00:03

WPScan

github.com

cve-2024-5570

authorization check bypass

arbitrary settings update

wordpress plugin

AI Score

6.6

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:tobias_cichon:simple_photoswipe:*:*:*:*:*:*:*:*"
    ],
    "vendor": "tobias_cichon",
    "product": "simple_photoswipe",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "0.1"
      }
    ],
    "defaultStatus": "unknown"
  }
]