PT-2026-65444 · Wedevs · Storegrowth – Upsell
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo category msg create() AJAX handler, which is registered for both authenticated (wp ajax ) and unauthenticated (wp ajax nopriv ) users and only validates a nonce ('ajd protected') that is emitted publicly via wp localize script() on every frontend page through front scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg bogo general settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Storegrowth – Upsell