WordPress Plugin Vulnerabilities
Church Admin < 4.4.5 - Missing Authorization
Description
The Church Admin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete-household cas in versions up to, and including, 4.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete households.
Affects Plugins
Fixed in 4.4.5 References
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Ngô Thiên An (ancorn_)
Verified
No
WPVDB ID
Timeline
Publicly Published
2024-06-28 (about 2 years ago)
Added
2024-07-03 (about 2 years ago)
Last Updated
2024-07-03 (about 2 years ago)
WPScan 