PT-2023-12477 · WordPress · Pwa For Wp & Amp

Jerome Bruandet · Published 2023-06-07 · Updated 2023-06-14 · CVE-2021-4366

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PWA for WP & AMP plugin for WordPress versions up to, and including, 1.7.32

Description The issue is related to authorization bypass due to a missing capability check on the pwaforwp update features options function. This allows authenticated attackers to change restricted settings within the plugin.

Recommendations For PWA for WP & AMP plugin for WordPress versions up to, and including, 1.7.32, update to a version higher than 1.7.32 to resolve the issue. As a temporary workaround, consider restricting access to the pwaforwp update features options function until a patch is available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-4366

Affected Products

Pwa For Wp & Amp

References · 5

• 🔥 https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2021-4366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4366 · Security Note
• https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cve · Note