12 Step Meeting List < 3.14.29 - Subscriber+ CSV Download

2024-01-2400:00:00

wpscan.com

plugin

authorisation

csv

meeting

export

sensitive information

9.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not have authorisation in its csv AJAX action, allowing any authenticated users, such a subscriber to export meetings and gain access to sensitive information

CPENameOperatorVersion
eq3.14.29

CPE	Name	Operator	Version
		eq	3.14.29

References

patchstack.com/database/vulnerability/12-step-meeting-list/wordpress-12-step-meeting-list-plugin-3-14-26-broken-access-control-vulnerability