Lucene search
WpvulndbWPVDB-ID:F7993326-65EA-429A-97EC-89B1F3B85A22HistoryFeb 12, 2024 - 12:00 a.m.
NextMove Lite < 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation
2024-02-1200:00:00
wpscan.com
3
nextmove lite
vulnerability
capability check
unauthorized modification
data
authenticated attackers
subscriber access
arbitrary plugins
6.3 Medium
AI Score
Confidence
High
Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the ‘xl_addon_installation’ function, allowing authenticated attackers, with subscriber access and above, to install and activate arbitrary plugins.
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 2.18.0 |
