Lucene search

K
wpvulndbWpvulndbWPVDB-ID:90A276A4-252F-45FE-921B-FA87E70AB4FD
HistoryApr 16, 2024 - 12:00 a.m.

GP Unique ID < 1.5.6 - Unauthenticated Form Submission Unique ID Modification

2024-04-1600:00:00
wpscan.com
5
plugin
unique id
modification
input validation
unauthenticated attackers
form submission

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

Description The plugin is vulnerable to Unique ID Modification due to insufficient input validation. This makes it possible for unauthenticated attackers to tamper with the generation of a unique ID on a form submission and replace the generated unique ID with a user-controlled one, leading to a loss of integrity in cases where the ID’s uniqueness is relied upon in a security-specific context.

CPENameOperatorVersion
eq1.5.6

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

Related for WPVDB-ID:90A276A4-252F-45FE-921B-FA87E70AB4FD