WordPress Plugin Vulnerabilities

Soumettre.fr <= 2.1.5 - Unauthenticated Soumettre Posts Creation/Modification/Deletion

Description

The plugin is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signature function. This makes it possible for unauthenticated attackers to create/edit/delete Soumettre posts. This vulnerability affects only installations where the soumettre account is not connected (i.e. API key is not installed)

Affects Plugins

Fixed in 2.1.6

References

Classification

Type
INCORRECT AUTHORISATION
CWE
CVSS

Miscellaneous

Original Researcher
Trương Hữu Phúc (truonghuuphuc)
Verified
No

Timeline

Publicly Published
2025-07-01 (about 1 year ago)
Added
2025-07-01 (about 1 year ago)
Last Updated
2025-10-07 (about 1 year ago)

Other