WordPress Plugin Vulnerabilities

10Web Map Builder for Google Maps < 1.0.74 - Missing Authorization to Notice Dismissal

Description

The 10Web Map Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gmwd_bp_install_notice_status function in versions up to, and including, 1.0.73. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to dismiss installation notices.

Affects Plugins

Fixed in 1.0.74

References

Classification

Type
NO AUTHORISATION
CWE

Miscellaneous

Original Researcher
Abdi Pranata
Verified
No

Timeline

Publicly Published
2023-09-13 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2023-12-12 (about 2 years ago)

Other