WordPress Plugin Vulnerabilities
Unauthorised AJAX Calls via Freemius
Description
The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in admin toggle the debug mode via a CSRF attack.
Proof of Concept
To access debug logs, as any authenticated user: https://example.com/wp-admin/admin-ajax.php?action=fs_get_debug_log
Affects Plugins
Fixed in 5.14.0.4
Fixed in 1.9.4
Fixed in 7.0.5
Fixed in 2.5.0
Fixed in 2.1.34
Fixed in 4.4.0
Fixed in 1.9.6
Fixed in 1.5.3
Fixed in 2.7.17
Fixed in 1.11.14
Fixed in 2.8.2.7
Fixed in 7.1.4
Fixed in 1.2.5
Fixed in 3.0.6
Fixed in 1.17.0
Fixed in 3.5.5
Fixed in 1.2.9
Fixed in 2.1.8
Fixed in 5.2.9
Fixed in 5.4.4
Fixed in 1.8.20
Fixed in 4.4.0.2
Fixed in 2.6.3
Fixed in 6.3.4
Fixed in 3.1.5
Fixed in 5.3.0.1
Fixed in 2.23.1
Fixed in 5.7.10
Fixed in 1.6.0
Fixed in 3.17.2
Fixed in 1.3.16
Fixed in 2.7.0
Fixed in 1.14.3
Fixed in 2.3.5
Fixed in 4.0.5
Fixed in 3.1.7
Fixed in 0.10.2
Fixed in 2.4.13
Fixed in 2.2
Fixed in 2.8.3
Fixed in 3.5.5
Fixed in 4.3
Fixed in 2.3.8
Fixed in 1.5.9
Fixed in 1.8.5
Fixed in 2.9.2
Fixed in 2.4.5
Fixed in 4.1.91
Fixed in 1.3.33
Fixed in 3.0.2
Fixed in 4.7.5
Fixed in 1.3.0
Fixed in 2.4.3.1
Fixed in 2.3.1
Fixed in 1.4.3
Fixed in 2.2.2
Fixed in 5.4.3
Fixed in 2.1
Fixed in 1.3.0
Fixed in 1.5.4
Fixed in 4.3
Fixed in 2.5.4
Fixed in 1.7.1
Fixed in 4.7.4 
No known fix
Fixed in 3.1.4
Fixed in 6.0.0
Fixed in 4.3
Fixed in 11.3.4
Fixed in 5.1.4
Fixed in 2.6.1
Fixed in 5.7.0
Fixed in 3.0.0
Fixed in 1.5.1
Fixed in 2.3.4
Fixed in 2.1.7
Fixed in 2.1.2
Fixed in 2.3.6
Fixed in 1.4.4
Fixed in 1.3.1
Fixed in 2.2.3
Fixed in 5.1.27
Fixed in 2.0.1
Fixed in 3.5.5.2
Fixed in 4.0.3
Fixed in 1.4.5.0
Fixed in 2.6.3
Fixed in 2.6
Fixed in 5.135
Fixed in 3.3.11
Fixed in 1.0.6
Fixed in 2.0.28.220224
Fixed in 1.7.7
No known fix
Fixed in 30.3.0
Fixed in 3.3.33
Fixed in 2.2.9
Fixed in 1.4.3
Fixed in 7.6.3
Fixed in 4.3.1
Fixed in 3.1
Fixed in 5.3.8
Fixed in 1.7.5
Fixed in 1.3.7
Fixed in 3.6.4
No known fix
Fixed in 1.9.9.170
Fixed in 3.0.10
Fixed in 3.8.2
Fixed in 2.1.3
Fixed in 1.2.6
No known fix
Fixed in 1.3.1
Fixed in 3.4.9.2
Fixed in 1.7.13
Fixed in 1.3.1
Fixed in 2.2.6
Fixed in 1.2.12
Fixed in 3.11.4
Fixed in 1.5.2
Fixed in 0.0.1
Fixed in 1.2.7
Fixed in 2.1.5
Fixed in 1.49.0
Fixed in 1.9.8
Fixed in 1.4.1
Fixed in 1.2.4
Fixed in 1.5.11
Fixed in 2.2.3
Fixed in 1.9.2
Fixed in 2.8.4
Fixed in 3.5.0
Fixed in 1.2.4
Fixed in 3.6.2
Fixed in 2.24.13
Fixed in 1.8.8
Fixed in 2.0.0
Fixed in 1.6.5
Fixed in 3.7.5
Fixed in 1.30.0
Fixed in 2.2
Fixed in 4.3.1
Fixed in 1.43.10.1
Fixed in 2.3
Fixed in 3.8.5
Fixed in 8.0.2
Fixed in 2.2.1
No known fix
Fixed in 5.7.22
Fixed in 9.2.17
Fixed in 2.9.1
Fixed in 1.5.5
Fixed in 4.9.14
Fixed in 4.0.2
Fixed in 2.0.3
Fixed in 1.6.1
Fixed in 1.3.5
Fixed in 2.1
Fixed in 1.4
Fixed in 4.2.18
Fixed in 4.3000000016
Fixed in 1.13.6
Fixed in 1.6.11
Fixed in 3.1.12
Fixed in 1.4.2
Fixed in 2.2.3
Fixed in 4.3
Fixed in 1.4.17
Fixed in 2.1.15
Fixed in 4.1.8
Fixed in 2.4.0.6
Fixed in 1.6.72
Fixed in 2.1.8
Fixed in 2.1.5
Fixed in 6.6.3
Fixed in 2.0.14
Fixed in 1.67
No known fix
Fixed in 5.3.1
Fixed in 4.2.0
Fixed in 1.5.0
Fixed in 3.6.3
No known fix
No known fix
Fixed in 1.1.18
Fixed in 0.9.6
Fixed in 2.2.3
Fixed in 1.5.0
Fixed in 3.0.9
Fixed in 1.5.1
Fixed in 1.0.5
Fixed in 1.5.23
No known fix
Fixed in 5.7.1
Fixed in 4.4.8
Fixed in 5.1.10
Fixed in 4.5.5
Fixed in 2.1.9
Fixed in 2.6.3
Fixed in 3.6.0
Fixed in 1.2.4
Fixed in 3.6
Fixed in 1.1.7.0
Fixed in 1.5.0
Fixed in 1.1.9
Fixed in 2.2.8
No known fix
Fixed in 1.3.2
Fixed in 1.2.7
Fixed in 1.8.5
Fixed in 3.1.4
Fixed in 3.0.2
Fixed in 2.0.21
Fixed in 2.9
Fixed in 1.5.2
Fixed in 2.7.6
Fixed in 1.1.6
Fixed in 0.6.7
Fixed in 1.1.0
Fixed in 1.1.13
Fixed in 1.8.01
Fixed in 17.5.3
Fixed in 2.1.4
Fixed in 1.3.6
No known fix
Fixed in 3.4.2
No known fix
Fixed in 2.1
Fixed in 2.2.3
Fixed in 3.1.0
Fixed in 1.8.1
Fixed in 1.2.3
Fixed in 1.2.4
Fixed in 1.5.13
No known fix
Fixed in 1.13.1.1
Fixed in 1.4
Fixed in 1.3.5
Fixed in 4.16.4
Fixed in 4.0
Fixed in 1.4.6
No known fix
Fixed in 1.1.8
Fixed in 1.1.13
Fixed in 3.3.3
Fixed in 1.0.8
No known fix
Fixed in 5.2.1
Fixed in 2.2.5
Fixed in 1.1.8
Fixed in 1.5.1
Fixed in 1.6
Fixed in 2.0.0
Fixed in 1.0.11
Fixed in 1.0.7
Fixed in 1.3.16
Fixed in 1.2.2
Fixed in 2.15.14
Fixed in 2.1.7
Fixed in 3.1.6
Fixed in 1.9.5
Fixed in 1.2.7
Fixed in 1.0.8
Fixed in 1.3.2
Fixed in 4.2.1
Fixed in 1.0.3
Fixed in 1.1.9
Fixed in 1.2.3
No known fix
Fixed in 1.7.1
Fixed in 1.7.3.2
No known fix
Fixed in 1.0.6
No known fix
Fixed in 3.6.1
Fixed in 1.2.2
Fixed in 2.42.1
Fixed in 1.3.9
Fixed in 1.2.3
Fixed in 1.5.0
No known fix
Fixed in 1.8.02
Fixed in 0.8
No known fix
Fixed in 1.0.1
Fixed in 1.0.9
Fixed in 1.7.91
Fixed in 3.0.5
Fixed in 1.3.1
No known fix
Fixed in 2.2.9
No known fix
Fixed in 1.1.3
Fixed in 1.4.3
No known fix
Fixed in 1.6.1
Fixed in 2.4.3
No known fix
Fixed in 1.2.1
No known fix
Fixed in 1.1.8
Fixed in 5.3.6
Fixed in 1.2.39
Fixed in 2.1.17
Fixed in 1.2.8
Fixed in 3.0.3
Fixed in 1.0.5
Fixed in 1.2.0
Fixed in 1.6.1
Fixed in 2.3.2
Fixed in 1.0.4
Fixed in 1.3.2
No known fix
Fixed in 1.1.17
Fixed in 1.6.18
Fixed in 3.3.33
Fixed in 1.4.5
Fixed in 1.3.4
Fixed in 0.11.0
Fixed in 2.0.4
Fixed in 1.0.4
No known fix
Fixed in 1.2.1
No known fix
Fixed in 1.2.1
No known fix
Fixed in 1.7
Fixed in 0.5.2
Fixed in 2.8.12
Fixed in 2.9.50
Fixed in 2.0
No known fix
Fixed in 1.9.2
Fixed in 2.1.6
Fixed in 2.6.8
Fixed in 3.6.0
Fixed in 1.0.3
Fixed in 1.2.0
No known fix
Fixed in 1.3.28
Fixed in 1.5.0
Fixed in 2.15.8
Fixed in 1.5.3
Fixed in 3.6
No known fix
Fixed in 1.1.8
Fixed in 1.1
Fixed in 1.2.6
Fixed in 1.2.4
Fixed in 1.1.10
No known fix
Fixed in 1.2.2
Fixed in 1.3.13
Fixed in 4.12.9
Fixed in 1.0.14
Fixed in 2.1.0
Fixed in 2.0.0
Fixed in 1.1.2
Fixed in 2.0.5
Fixed in 1.6.0
Fixed in 3.14.6
Fixed in 1.8.2
Fixed in 1.2.3
Fixed in 1.3.23
Fixed in 2.3.1
Fixed in 1.13.0
No known fix
Fixed in 1.0.9
Fixed in 1.9.6
Fixed in 2.3.11
Fixed in 5.4.1
Fixed in 2.0
Fixed in 1.17.0.4
Fixed in 1.1.0
Fixed in 1.2.4
No known fix
Fixed in 1.0.6
Fixed in 2.3.5
Fixed in 1.3
Fixed in 3.0.1
Fixed in 3.4.1
Fixed in 1.0.4
Fixed in 1.7.4
Fixed in 1.1.0
Fixed in 1.0.4
Fixed in 1.0.17
Fixed in 1.2.3
Fixed in 1.0.6
Fixed in 1.4.9
Fixed in 1.2.5
Fixed in 4.0.9
Fixed in 1.0.4
Fixed in 1.4.6
Fixed in 1.9.0
No known fix
No known fix
No known fix
Fixed in 3.20.2
Fixed in 1.0.6
Fixed in 3.0.26
Fixed in 2.2.4
Fixed in 1.0.1
No known fix
Fixed in 1.0.4
No known fix
Fixed in 1.0.13
Fixed in 1.4.1
Fixed in 1.1.4
Fixed in 2.3
Fixed in 1.2.3
Fixed in 1.2.4
Fixed in 1.0.1
No known fix
Fixed in 2.0.4
Fixed in 1.4.5
Fixed in 1.3.0
Fixed in 2.1.2
Fixed in 1.0.4
Fixed in 1.0.4
Fixed in 1.2
Fixed in 4.3.1
Fixed in 1.4.1
Fixed in 1.4.3
No known fix
Fixed in 1.6.1
No known fix
Fixed in 4.24.0
Fixed in 3.1.2
Fixed in 1.4.1
Fixed in 2.0.5
No known fix
Fixed in 1.1.1
Fixed in 1.8.1
Fixed in 1.8.0
Fixed in 1.2.0
Fixed in 2.2.5
Fixed in 1.0.8 Affects Themes
No known fix
No known fix
Fixed in 1.0.8
Fixed in 1.0.5
No known fix
Fixed in 1.0.1
Fixed in 2.2.7
Fixed in 1.1.0
Fixed in 1.0.8
No known fix
Fixed in 1.2.2
Fixed in 1.1.3
Fixed in 1.6.5
Fixed in 1.0.11
Fixed in 1.1.01
Fixed in 1.2.4.2
Fixed in 1.0.5
No known fix
No known fix
No known fix
Fixed in 2.0.3
No known fix
Fixed in 1.8.6
No known fix
No known fix Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2022-02-28 (about 2 years ago)
Added
2022-02-28 (about 2 years ago)
Last Updated
2023-07-11 (about 10 months ago)
WPScan 