iPanorama 360 WordPress Virtual Tour Builder < 1.8.2 - Missing Authorization

2024-05-0700:00:00

wpscan.com

ipanorama 360

wordpress

virtual tour builder

vulnerable

unauthorized access

rest api

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

8.7%

JSON

Description The iPanorama 360 WordPress Virtual Tour Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on a REST API endpoint in versions up to, and including, 1.8.1. This makes it possible for unauthenticated attackers to view deactivated panoramas.