WordPress Plugin Vulnerabilities

WP Upload Restriction < 2.2.5 - Missing Access Control in getSelectedMimeTypesByRole

Description

Missing access control in getSelectedMimeTypesByRole function allows authenticated users, such as subscribers, to retrieve approved mime types for any given role.

Affects Plugins

Plugin icon
wp-upload-restriction
Fixed in 2.2.5

References

CVE
CVE-2021-34627

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Verified
Yes
WPVDB ID
3379ca30-96c3-4fbd-ab5a-67ec3f4dc479

Timeline

Publicly Published
2021-07-07 (about 4 years ago)
Added
2021-07-07 (about 4 years ago)
Last Updated
2021-09-02 (about 4 years ago)

Other

Published
Title
Published
2021-04-22
Title
Multiple WP-Buy Plugins - Arbitrary Plugin Installation/Activation via Low Privilege User
Published
2021-03-16
Title
Flo Forms < 1.0.36 - Authenticated Options Change to Stored XSS
Published
2024-05-21
Title
AI ChatBot < 5.3.6 - Missing Authorization via openai_file_delete_callback
Published
2023-12-22
Title
easy.jobs < 2.4.7 - Subscriber+ Arbitrary Settings Update
Published
2022-01-24
Title
WP Dependency Installer < 4.3.1 - Subscriber+ Arbitrary Plugin Activation