Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.35.1 - Authorization Bypass
2021-06-30 00:00
WPScanTeamStrategic Overview
StatusPatched in 1.2.35.2
Affected PluginMailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
Affected Version
<= 1.2.35.1CVSS7.3High
CVE
N/AVulnerability Overview
The Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the fetch_custom_fields and fetch_tags functions in versions up to, and including, 1.2.35.1. This makes it possible for unauthenticated attackers to read and edit Elementor custom fields and tags.
Technical Analysis
REMEDIATION: Update to version 1.2.35.2, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C