RestroPress <= 2.8.3 - Missing Authorization
2021-07-19 00:00
WPScanTeamStrategic Overview
StatusPatched in 2.8.3.1
Affected PluginRestroPress – Online Food Ordering System
Affected Version
<= 2.8.3CVSS5.4Medium
CVE
N/AVulnerability Overview
The RestroPress plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 2.8.3. This is due to improper nonce and capability checks in several of the AJAX calls. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to access restricted order information and edit the order status.
Technical Analysis
REMEDIATION: Update to version 2.8.3.1, or a newer patched version --- IDENTIFIER: CWE-284 (Improper Access Control) The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C