Sirv < 7.1.3 - Missing Authorization via sirv_disconnect

2024-01-0400:00:00

wpscan.com

sirv

wordpress

vulnerability

unauthorized modification

data

missing capability check

sirv_disconnect

ajax

version 7.1.2

authenticated attackers

subscriber-level access

disconnect

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Description The Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sirv_disconnect function hooked via AJAX in versions up to, and including, 7.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to disconnect the sites serv account.