WordPress Plugin Vulnerabilities

WP Upload Restriction < 2.2.5 - Missing Access Control in deleteCustomType

Description

Missing access control in deleteCustomType function allows authenticated users, such as subscribers, to delete custom extensions.

Affects Plugins

Plugin icon
wp-upload-restriction
Fixed in 2.2.5

References

CVE
CVE-2021-34626

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Verified
Yes
WPVDB ID
06df53e6-b97d-41bc-a96a-6008a1358570

Timeline

Publicly Published
2021-07-07 (about 4 years ago)
Added
2021-07-07 (about 4 years ago)
Last Updated
2021-09-02 (about 4 years ago)

Other

Published
Title
Published
2021-05-08
Title
ThemeHigh WooCommerce Wishlist and Comparison < 1.0.5 - Unauthorised AJAX call
Published
2024-02-27
Title
LifterLMS – WordPress LMS Plugin for eLearning < 7.5.2 - Missing Authorization via process_review
Published
2021-10-05
Title
JobSearch WP Job Board < 1.8.2 - Unauthenticated Plugin's Settings Update
Published
2021-12-29
Title
Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion
Published
2021-08-31
Title
WooCommerce Dynamic Pricing & Discounts < 2.4.2 - Unauthenticated Settings Export