EmbedPress < 3.8.3 - Subscriber+ Plugin Settings Delete

2023-08-1000:00:00

wpscan.com

plugin

authorize access

admin post remove

remove private data

low privileged users

subscribers

delete

settings

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

30.0%

JSON

Description The plugin does not properly authorize access to its admin_post_remove and remove_private_data actions, allowing low privileged users (such as subscribers) to delete plugin settings.

References

www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/embedpress/embedpress-382-missing-authorization-to-authenticated-subscriber-plugin-settings-delete-via-admin-post-remove-and-remove-private-data