PilotPress < 2.0.31 - Subscriber+ Report Access & DB Transients Purging

2024-02-0500:00:00

wpscan.com

pilotpress

vulnerability

unauthorized access

data loss

capability check

ajax

authenticated attackers

subscriber access

AI Score

9.3

Confidence

High

EPSS

0.001

Percentile

20.0%

JSON

Description The plugin is vulnerable to unauthorized access to data and loss of data due to a missing capability check on multiple AJAX functions, allowing authenticated attackers, with subscriber access and above, to view reports and purge database transients.