ColorMag < 3.1.3 - Missing Authorization to Arbitrary Plugin Installation

2024-01-2400:00:00

wpscan.com

vulnerable

unauthorized access

capability check

plugin installation

authenticated attackers

subscriber-level access

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.1%

JSON

Description The plugin is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() function in all versions up to, allowing authenticated attackers, with subscriber-level access and above, to install and activate arbitrary plugins.