Lucene search
WpvulndbWPVDB-ID:D196D099-E9CA-4E57-904B-A46AF65F7445HistoryJun 16, 2022 - 12:00 a.m.
BuddyPress Group Reviews < 2.8.4 - Subscriber+ Arbitrary Settings Update & Review Modification
2022-06-1600:00:00
wpscan.com
14
buddypress
group reviews
plugin
missing capability
csrf checks
ajax functions
authenticated users
arbitrary settings
modify reviews
EPSS
0.001
Percentile
40.4%
The plugin is missing capability and CSRF checks in various of its AJAX functions available to any authenticated users, which could allow users with a role as low as subscriber to update arbitrary settings and modify reviews
Related
nvd
nvd
CVE-2022-2108
2022-07-18 17:15:08
cvelist
cvelist
CVE-2022-2108
2022-07-18 16:12:54
cve
cve
CVE-2022-2108
2022-07-18 17:15:08
prion
prion
Design/Logic Flaw
2022-07-18 17:15:00
patchstack
patchstack