ProjectHuddle Client Site < 1.0.35 - Missing Authorization via ph_child_ajax_notice_handler

2024-01-0400:00:00

wpscan.com

wordpress

plugin

vulnerability

authorization

data modification

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The ProjectHuddle Client Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘ph_child_ajax_notice_handler’ function in versions up to, and including, 1.0.34. This makes it possible for authenticated attackers, with subscriber-level access and above, to dismiss admin notices.