CVE-2019-25214

ShopWP <= 2.0.4 - Missing Authorization to Stored Cross-Site Scripting

CVSS 7.2 HIGHEPSS 0.3%◆ VulnCheck KEVCWE-862

Vexday Risk Score

43Atenção

Decisão SSVC (CISA)

Act

Exploração + impacto → ação imediata

CVSS 7.2EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

16 out 2024Publicada no NVD

Recomendação: Corrigir o quanto antes — há exploração ativa confirmada.

The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as updating the plugin's settings and injecting malicious scripts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Produtos afetados

andrewmrobbins · ShopWP

Referências

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2132502%40wpshopify&new=2132502%40wpshopify&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/d04f11b4-ee58-428b-aaa2-dc7d9f3e68e3?source=cve