Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization Checks
2023-01-25 00:00
AnonymousStrategic Overview
StatusPatched in 2.3.2
Affected PluginSpectra Legacy – Gutenberg Blocks
Affected Version
<= 2.3.1CVSS6.3Medium
CVE
N/AVulnerability Overview
The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the import_wpforms, import_block, and activate_plugin functions called via AJAX actions in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, such as subscribers, to activate arbitrary plugins and import blocks and forms from WPForms.
Technical Analysis
REMEDIATION: Update to version 2.3.2, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C