PT-2026-64226 · Wpify · Wpify Woo – Withdrawal
CVSS v3.1
8.0
Alta
| Vetor | AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update option() without any option-name allowlist or value sanitization, while the permission callback only verifies the manage woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default role to administrator and users can register to 1, or disabling security plugins via active plugins).
Correção
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wpify Woo – Withdrawal