Piotnet Forms < 1.0.30 - Missing Authorization via multiple AJAX actions

2024-01-0300:00:00

wpscan.com

piotnet forms

missing authorization

ajax actions

unauthenticated attackers

data modification

9.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX functions, allowing unauthenticated attackers to save draft posts and download arbitrary JSON files from the server.