WordPress Plugin Vulnerabilities

User Rights Access Manager < 1.0.8 - Access Restriction Bypass

Description

The plugin does not properly restrict access to pages, allowing admin users with restricted access (done by the plugin) to still access the related pages.

The issue is the same technique than https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-plugin/

Proof of Concept

Affects Plugins

Plugin icon
user-rights-access-manager
Fixed in 1.0.8

Miscellaneous

Verified
Yes
WPVDB ID
2ea6e7c4-7570-4caa-9320-f01d552b3474

Timeline

Publicly Published
2021-08-05 (about 4 years ago)
Added
2021-08-05 (about 4 years ago)
Last Updated
2022-01-05 (about 4 years ago)

Other

Published
Title
Published
2014-12-02
Title
InfiniteWP Client <= 1.3.7 - Privilege Escalation
Published
2014-09-19
Title
Last.fm Rotation 1.0 - lastfm-proxy.php snode Parameter Remote Path Traversal File Access
Published
2024-02-01
Title
UserPro < 5.1.7 - Disabled Membership Registration Bypass
Published
2020-03-18
Title
Gutenberg & Elementor Templates Importer For Responsive < 2.2.6 - Unprotected AJAX Endpoints
Published
2020-05-19
Title
WP Frontend Profile < 1.2.2 - CSRF Check Incorrectly Implemented