WordPress Plugin Vulnerabilities

Animator < 3.0.11 - Missing Authorization to Plugin Settings Update

Description

The Animator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sta_update_options() function in versions up to, and including, 3.0.10. This makes it possible for subscribers to modify the plugin's settings. Version 3.0.9 used to provide a nopriv action hook, which allowed unauthenticated individuals to perform this task.

Affects Plugins

References

Classification

Type
NO AUTHORISATION
CWE

Miscellaneous

Original Researcher
Elliot
Verified
No

Timeline

Publicly Published
2023-11-09 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other