Load More Anything < 3.3.4 - Subscriber+ Settings Update

2024-02-0400:00:00

wpscan.com

plugin

authorization

vulnerability

settings

updates

unauthorized

9.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them

CPENameOperatorVersion
eq3.3.4

CPE	Name	Operator	Version
		eq	3.3.4

References

patchstack.com/database/vulnerability/ajax-load-more-anything/wordpress-load-more-anything-plugin-3-3-3-broken-access-control-vulnerability