Radio Player <= 2.0.73 - Missing Authorization to Player Update
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
exploitation probability
0.4%top 66% of all CVEs
observed exploitation
nono source reports it
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
https://plugins.svn.wordpress.org/radio-player/tags/2.0.7/readme.txthttps://plugins.trac.wordpress.org/changeset/2942906/radio-player/trunk/includes/class-ajax.phphttps://plugins.trac.wordpress.org/changeset/3048105https://www.wordfence.com/threat-intel/vulnerabilities/id/77409977-6822-4d14-9842-cb6a5aff2162?source=cve