Lucene search
WpvulndbWPVDB-ID:295E9BDD-7BF9-41EA-9043-20652CD73B6BHistoryOct 30, 2023 - 12:00 a.m.
Deeper Comments <= 2.1.1 - Subscriber+ Arbitrary Options Update
2023-10-3000:00:00
wpscan.com
1
deeper comments
plugin
unauthorized
update options
arbitrary
ajax
action
authenticated users
subscribers
blog options
7 High
AI Score
Confidence
High
Description The plugin does not have authorisation in its update_options AJAX action, allowing any authenticated users, such as subscribers to update arbitrary blog options (like default_role etc)
7 High
AI Score
Confidence
High