WordPress Plugin Vulnerabilities
GDPR Cookie Consent < 1.8.3 - Improper Access Controls
Description
Improper Access Controls issue in the cli_policy_generator AJAX call which could allow an authenticated user with low privileges (such as a subscriber) to:
- Change the status of any post/page from published to draft, removing them from the frontend of the blog.
- Put a payload in the content of one of them, leading to Stored Cross-Site Scripting (XSS) issues.
Affects Plugins
Fixed in 1.8.3 References
Miscellaneous
Original Researcher
Jerome Bruandet (nintechnet.com)
Verified
No
WPVDB ID
Timeline
Publicly Published
2020-02-12 (about 6 years ago)
Added
2020-02-12 (about 6 years ago)
Last Updated
2020-08-22 (about 5 years ago)
WPScan 