REST API TO MiniProgram <= 4.7.7 - Authenticated (Subscriber+) Media Attachment Deletion
Strategic Overview
<= 4.7.7CVE-2023-0551Vulnerability Overview
The REST API TO MiniProgram plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the file_batch_delete_callback() function used to delete uploaded attachments in versions up to, and including, 4.7.7. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete arbitrary media files on a WordPress site.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C