Lucene search

WpvulndbWPVDB-ID:038FC71C-5970-4A2D-B1A8-92594589F4ED

HistoryApr 03, 2024 - 12:00 a.m.

Sliced Invoices < 3.9.3 - Missing Authorization

2024-04-0300:00:00

wpscan.com

sliced invoices

wordpress

unauthorized access

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

6.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Description The Sliced Invoices plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sure_to_email() function in versions up to, and including, 3.9.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails.

References

www.wordfence.com/threat-intel/vulnerabilities/id/c17d7fba-7b98-4a7a-a35e-78f16be81aca

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

6.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for WPVDB-ID:038FC71C-5970-4A2D-B1A8-92594589F4ED