MSHOP MY SITE <= 1.1.7 - Subscriber+ Settings Update

2023-11-2300:00:00

wpscan.com

plugin

unauthorized access

settings update

subscribers

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.1%

JSON

Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them

References

patchstack.com/database/vulnerability/mshop-mysite/wordpress-mshop-my-site-plugin-1-1-6-broken-access-control-vulnerability