Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access

2024-06-0600:00:00

Scott Kingsley Clark

arbitrary option access

contributor+

exploit

update deadline

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not prevent users with at least the contributor role using some of its shortcode’s functionalities to leak arbitrary options from the database.

1. ADMIN: Install Kadence Blocks Pro
2. CONTRIBUTOR: Add shortcode to any post and specify/guess the option name and save
3. CONTRIBUTOR: Preview the post and see option you shouldn't have access to

Example shortcode: `[kb-dynamic para="kb_custom_input" custom="active_plugins" field="site|custom_setting"]`