50
CVE-2018-11579
PoC —CVSS 3.0
5.3 medium
EPSS
<1%p59
Published
()
Modified
Description
class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.
- Vendors
- multidots
- Products
- woocommerce category banner management
- Ecosystems
- WordPress, E-commerce
- Weakness
- CWE-287
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N