Lucene search

WpvulndbWPVDB-ID:1F513628-346E-4430-92AC-DCDEA00C7446

HistoryMay 01, 2024 - 12:00 a.m.

KB Support < 1.6.1 - Missing Authorization

2024-05-0100:00:00

wpscan.com

wordpress

kb support

vulnerable

unauthorized access

data

capability check

missing

1.6.0

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The KB Support plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the kbs_ajax_display_ticket_notes and kbs_ajax_display_ticket_replies function in versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to view ticket notes and replies.

CPENameOperatorVersion
eq1.6.1

CPE	Name	Operator	Version
		eq	1.6.1

References

www.wordfence.com/threat-intel/vulnerabilities/id/9148268a-1179-4bc5-b388-309cf08510d7

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for WPVDB-ID:1F513628-346E-4430-92AC-DCDEA00C7446