Revive Old Posts – Social Media Auto Post and Scheduling Plugin < 8.0.0 - Authorization Bypass
Strategic Overview
< 8.0.0N/AVulnerability Overview
The Revive Old Posts – Social Media Auto Post and Scheduling Plugin for WordPress is vulnerable to Authorization Bypass due to a missing capability check on the update_response AJAX action in versions before 8.0.0. This makes it possible for unauthenticated attackers to create a new account with administrative-level privileges. This issue was not fully patched until the core.php file was removed in version 8.0.0 since the capability check implemented (is_admin) was not sufficient.
Technical Analysis
REMEDIATION: Update to version 8.0.0, or a newer patched version --- IDENTIFIER: CWE-285 (Improper Authorization) The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C