PT-2025-6434 · WordPress · Wpsyncsheets Lite For Wpforms
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress versions up to, and including, 1.6
Description
The issue is related to unauthorized modification of data due to a missing capability check on the
wpsslwp reset settings() function. This allows authenticated attackers with Subscriber-level access and above to reset the plugin's settings.Recommendations
For versions up to, and including, 1.6, consider disabling the
wpsslwp reset settings() function until a patch is available to prevent unauthorized modification of data. Restrict access to the plugin's settings to minimize the risk of exploitation. Update to a version that includes a fix for this issue once it becomes available.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wpsyncsheets Lite For Wpforms