PT-2023-12477 · WordPress · Pwa For Wp & Amp

Jerome Bruandet · CVE-2021-4366 · Publicado 2023-06-07 · Atualizado 2023-06-14

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PWA for WP & AMP plugin for WordPress versions up to, and including, 1.7.32

Description The issue is related to authorization bypass due to a missing capability check on the pwaforwp update features options function. This allows authenticated attackers to change restricted settings within the plugin.

Recommendations For PWA for WP & AMP plugin for WordPress versions up to, and including, 1.7.32, update to a version higher than 1.7.32 to resolve the issue. As a temporary workaround, consider restricting access to the pwaforwp update features options function until a patch is available.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2021-4366

Produtos afetados

Pwa For Wp & Amp

Referências · 5

• 🔥 https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2021-4366 · Aviso do Fabricante
• https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-4366 · Nota de Segurança