PT-2025-3729 · WordPress · Post Grid/Gutenberg Blocks
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Post Grid and Gutenberg Blocks plugin for WordPress versions 2.2.85 through 2.3.3
Description
The issue arises from the plugin not properly restricting what user meta can be updated during profile registration, making it possible for unauthenticated attackers to register on the site as an administrator. This allows for privilege escalation. Thousands of sites are potentially exposed to complete takeover.
Recommendations
For versions 2.2.85 through 2.3.3, update to a version that properly restricts user meta updates during profile registration to prevent privilege escalation. As a temporary workaround, consider disabling profile registration or restricting access to the profile registration feature until a patch is available.
Correção
LPE
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Post Grid/Gutenberg Blocks