Lucene search

WordfenceCVE-2019-25151

HistoryJun 07, 2023 - 2:15 a.m.

CVE-2019-25151

2023-06-0702:15:10

CWE-269

Wordfence

web.nvd.nist.gov

cve-2019-25151

funnel builder

wordpress plugin

authorization bypass

capability check

nvd

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

40.7%

JSON

The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service.

Affected configurations

Nvd

Vulners

Node

cartflowscartflowsRange<1.3.1wordpress

VendorProductVersionCPE
cartflowscartflows*cpe:2.3:a:cartflows:cartflows:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
cartflows	cartflows	*	cpe:2.3:a:cartflows:cartflows::::::wordpress::*

CNA Affected

[
  {
    "vendor": "cartflowswp",
    "product": "WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

blog.nintechnet.com/privilege-escalation-vulnerability-fixed-in-wordpress-cartflows-plugin/

wpscan.com/vulnerability/b6725319-909f-4d5c-9b34-8b6ea627b223%5D

www.acunetix.com/vulnerabilities/web/wordpress-plugin-funnel-builder-by-cartflows-create-high-converting-sales-funnels-for-wordpress-privilege-escalation-1-3-0/

www.wordfence.com/threat-intel/vulnerabilities/id/f0b95670-0767-4325-88d0-4ae6d7302558?source=cve

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

40.7%

JSON

Related for CVE-2019-25151