RabbitLoader < 2.19.14 - Missing Authorization via multiple AJAX actions

2024-01-1500:00:00

wpscan.com

wordpress

rabbitloader

plugin

vulnerability

unauthorized modification

data loss

capability check

ajax

attack

subscriber-level access

cache

caching modes

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The RabbitLoader plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 2.19.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to purge site cache or switch caching modes.