WordPress Plugin Vulnerabilities
Orbit Fox by ThemeIsle <= 2.6.3 -Does not properly Authenticate REST API Calls
Description
Orbit Fox by Themeisle (aka Themeisle Companion) version <= 2.6.3 does not properly authenticate REST API calls allowing unauthenticated users to execute several API calls.
In some cases one of these calls can be used to upload arbitrary files which can lead to remote code execution.
Affects Plugins
Fixed in 2.6.4 Classification
Type
AUTHBYPASS
OWASP top 10
CWE
Miscellaneous
Original Researcher
James Golovich
Submitter
James Golovich
Submitter website
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2018-12-07 (about 7 years ago)
Added
2018-12-11 (about 7 years ago)
Last Updated
2018-12-11 (about 7 years ago)
WPScan 