Nested Pages <= 3.0.7 - Missing Authorization
2019-03-26 00:00
Bart DabekStrategic Overview
Vulnerability Overview
The Nested Pages plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 3.0.7. This makes it possible for authenticated attackers to edit other contributors' posts along with modifying the slugs and titles.
Technical Analysis
REMEDIATION: Update to version 3.0.8, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C