WordPress Plugin Vulnerabilities

PeepSo <= 1.6.0 - Authenticated Privilege Escalation

Description

Unfiltered input allows a logged in user to escalate their permissions to that of an Administrator.

Affects Plugins

Plugin icon
peepso-core
Fixed in 1.6.1

References

CVE
CVE-2016-10968
URL
https://www.pritect.net/blog/peepso-1-6-0-logged-user-privilege-escalation

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.8 (high)

Miscellaneous

Submitter
James Golovich
Submitter website
http://pritect.net
Submitter twitter
Pritect
Verified
No
WPVDB ID
38948a9d-fa4d-471e-bd6f-4d7db8208d11

Timeline

Publicly Published
2016-06-29 (about 9 years ago)
Added
2016-06-30 (about 9 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2020-02-17
Title
wpCentral < 1.5.1 - Improper Access Control to Privilege Escalation
Published
2025-07-08
Title
Responsive Coming Soon Landing Page / Holding Page for WordPress <= 3.0 - Authenticated (Susbcriber+) Privilege Escalation
Published
2020-11-09
Title
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Roles
Published
2020-01-16
Title
WP Database Reset < 3.15 - Privilege Escalation
Published
2023-08-09
Title
WP Project Manager < 2.6.5 - Subscriber+ Privilege Escalation