CVE-2019-25214

ShopWP <= 2.0.4 - Missing Authorization to Stored Cross-Site Scripting

CVSS 7.2 HIGHEPSS 0.3%◆ VulnCheck KEVCWE-862

Vexday Risk Score

43Attention

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

CVSS 7.2EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

16 Oct 2024Published on NVD

Recommendation: Patch as soon as possible — active exploitation confirmed.

The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as updating the plugin's settings and injecting malicious scripts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected products

andrewmrobbins · ShopWP

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2132502%40wpshopify&new=2132502%40wpshopify&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/d04f11b4-ee58-428b-aaa2-dc7d9f3e68e3?source=cve