Get URL Cron <= 1.4.7 - Missing Authorization via geturlcron_action_handle
2023-02-15 00:00
Rio DarmawanStrategic Overview
StatusPatched in 1.4.8
Affected PluginCron Setup and Monitor – Get URL Cron
Affected Version
<= 1.4.7CVSS7.5High
CVE
N/AVulnerability Overview
The Get URL Cron plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 1.4.7. This is due to a missing capability check on the geturlcron_action_handle function called via an init hook. This makes it possible for unauthenticated attackers to modify many of the plugin's settings, retrieve cron jobs, and create cron jobs.
Technical Analysis
REMEDIATION: Update to version 1.4.8, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C