WP Basic Elements <= 5.2.15 - Missing Authorization to Plugin Settings Update via wpbe_save_settings
2023-03-16 00:00
AnonymousStrategic Overview
Vulnerability Overview
The WP Basic Elements plugin for WordPress is vulnerable to modification of data due to a missing capability check on the wpbe_save_settings function in versions up to, and including, 5.2.15. This makes it possible for subscriber-level attackers to update plugin settings.
Technical Analysis
REMEDIATION: Update to version 5.3.0, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C