FunnelKit Checkout < 3.11.0 - Subscriber+ Arbitrary Plugin Activation

2024-01-0300:00:00

wpscan.com

funnelkit

checkout

wordpress

vulnerability

version 3.10.3

unauthorized modification

data

capability check

subscriber access

arbitrary plugins

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The FunnelKit Checkout plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unknown function in all versions up to, and including, 3.10.3. This makes it possible for authenticated attackers, with subscriber access and above, to activate arbitrary plugins.