Top 10 – Popular posts plugin for WordPress <= 3.2.4 - Missing Authorization on tptn_chart_data
2023-02-22 00:00
AnonymousStrategic Overview
StatusPatched in 3.2.5
Affected PluginWebberZone Top 10 — Popular Posts
Affected Version
<= 3.2.4CVSS4.3Medium
CVE
N/AVulnerability Overview
The Top 10 – Popular posts plugin for WordPress is vulnerable to insufficient access control in the 'tptn_chart_data' AJAX action in versions up to, and including, 3.2.4. This allows authenticated attackers to access chart data granted they can access the admin dashboard and retrieve the nonce used for access control.
Technical Analysis
REMEDIATION: Update to version 3.2.5, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C