TK Google Fonts GDPR Compliant <= 2.2.7 - Authorization Bypass
2023-05-05 00:00
AnonymousStrategic Overview
StatusPatched in 2.2.8
Affected PluginTK Google Fonts GDPR Compliant
Affected Version
<= 2.2.7CVSS7.3High
CVE
N/AVulnerability Overview
The TK Google Fonts GDPR Compliant plugin for wordPress is vulnerable to unauthenticated plugin settings update in versions up to, and including, 2.2.7 due to missing capability checks and missing nonce checks on the `tk_google_fonts_add_font` function that can be called by unauthenticated users via the `wp_ajax_nopriv_tk_google_fonts_add_font` AJAX action.
Technical Analysis
REMEDIATION: Update to version 2.2.8, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C