Enjoy Social Feed <= 6.2.2 - Subscriber+ Plugin Database Reset

2024-02-2000:00:00

Erwan LR (WPScan)

wpscan.com

enjoy social feed

vulnerability

database reset

authorization

subscribers

6.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not have authorisation when resetting its database, allowing any authenticated users, such as subscriber to perform such action

PoC

Log in as a subscriber, access the Diagnostic tab of the plugin (/wp-admin/admin.php?page=enjoyinstagram_plugin_options&tab;=diagnostic) and click on the re-install database button at the bottom