Lucene search

WpvulndbWPVDB-ID:D3515358-4107-4B44-A073-97E639E5EBCA

HistoryApr 25, 2024 - 12:00 a.m.

LoginPress Pro < 3.0.0 - Unauthenticated License Activation/Deactivation

2024-04-2500:00:00

wpscan.com

loginpress pro

wordpress

vulnerability

unauthorized modification

data

capability check

unauthenticated attacks

licenses

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS

Percentile

9.0%

JSON

Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check, allowing unauthenticated attacks to activate and deactivate licenses.

References

patchstack.com/database/vulnerability/loginpress-pro/wordpress-loginpress-pro-plugin-2-5-3-unauth-license-activation-deactivation-vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS

Percentile

9.0%

JSON

Related for WPVDB-ID:D3515358-4107-4B44-A073-97E639E5EBCA