Featured Image from URL <= 2.7.7 - Missing Authorization on REST API routes
2019-12-24 00:00
AnonymousStrategic Overview
StatusPatched in 2.7.8
Affected PluginFeatured Image from URL (FIFU)
Affected Version
<= 2.7.7CVSS7.3High
CVE
N/AVulnerability Overview
The Feature Image from URL plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on REST routes in versions up to, and including, 2.7.7. This makes it possible for unauthenticated attackers to access the vulnerable endpoints.
Technical Analysis
REMEDIATION: Update to version 2.7.8, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C