WPvivid < 0.9.95 - Missing Authorization

2024-01-2600:00:00

wpscan.com

wpvivid

plugin

unauthorized access

vulnerability

data

capability check

restore function

get_restore_progress function

unauthenticated attackers

file paths

back-up id

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.4%

JSON

Description The plugin vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_restore_progress() function, making it possible for unauthenticated attackers to invoke these functions and obtain full file paths if they have access to a back-up ID.