Starbox < 3.4.8 - Subscriber+ Plugin Preferences / User Settings Access via IDOR

2024-01-3100:00:00

wpscan.com

starbox plugin

idor

vulnerability

insecure direct object reference

user settings

subscriber+.

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.2%

JSON

Description The plugin is vulnerable to Insecure Direct Object Reference via the action function due to missing validation on a user controlled key. This makes it possible for subscribers to view plugin preferences and potentially other user settings.