Melhor Envio <= 2.11.19 - Cross-Site Request Forgery and Authenticated Settings Change
2022-04-26 00:00
AnonymousStrategic Overview
Vulnerability Overview
The Melhor Envio plugin for WordPress is vulnerable to authenticated settings changes and Cross-Site Request Forgery in versions up to, and including, 2.11.19. This allowed any authenticated user to directly modify plugin settings, and allowed unauthenticated users to modify the same settings if they could trick an authenticated user into performing an action, such as clicking a link.
Technical Analysis
REMEDIATION: Update to version 2.11.20, or a newer patched version --- IDENTIFIER: CWE-285 (Improper Authorization) The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C