Educare <= 1.4.6 - Missing Authorization to Sensitive Information Exposure
2023-09-09 00:00
AnonymousStrategic Overview
StatusPatched in 1.4.7
Affected PluginEducare – Students & Result Management System
Affected Version
< 1.4.7CVSS4.3Medium
CVE
N/AVulnerability Overview
The Educare plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the educare_get_data_from_students function in versions up to, and including, 1.4.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to expose potentially sensitive student data.
Technical Analysis
REMEDIATION: Update to version 1.4.7, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C