XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update
63Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 8.8epss 1.5%
from disclosure to weapon0 days
Published on NVDJun 6
1st PoCJun 6
VulnCheckJun 5
exploitation probability
1.5%top 28% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
xootix · Login & Register Customizer – Popup | Slider | Inline | WooCommercexootix · OTP Login & Register Woocommercexootix · Side Cart Woocommerce | Woocommerce Cartxootix · Waitlist Woocommerce ( Back in stock notifier )public PoCs found — 1
vulncheckvulncheck.com/xdb/1f1fa3466b65unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/trunk/includes/xoo-framework/admin/class-xoo-admin-settings.php#L83https://plugins.trac.wordpress.org/changeset/3093994/https://plugins.trac.wordpress.org/changeset/3111541/https://plugins.trac.wordpress.org/changeset/3115392/mobile-login-woocommerce/trunk?contextall=1&old=3084918&old_path=%2Fmobile-login-woocommerce%2Ftrunkhttps://plugins.trac.wordpress.org/changeset/3117332/https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=cve