WordPress Plugin Vulnerabilities
picu – Online Photo Proofing Gallery < 2.4.1 - Missing Authorization
Description
The picu – Online Photo Proofing Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the picu_trigger_proof_file_download() function in all versions up to, and including, 2.4.0. This makes it possible for unauthenticated attackers to download a proof file.
Affects Plugins
Fixed in 2.4.1 References
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
thiennv
Verified
No
WPVDB ID
Timeline
Publicly Published
2024-12-22 (about 1 year ago)
Added
2025-02-19 (about 1 year ago)
Last Updated
2025-02-19 (about 1 year ago)
WPScan 