vSlider Multi Image Slider <= 4.1.2 - Missing Authorization
Strategic Overview
<= 4.1.2N/AVulnerability Overview
The vSlider Multi Image Slider plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to missing capability checks on several functions such as vslider_admin_callback, vslider_images_callback, and vslider_generate_images_callback in versions up to, and including, 4.1.2. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugin's settings, retrieve settings, and manipulate sliders.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C