WordPress Plugin Vulnerabilities

ShopLentor < 2.8.2 - Contributor+ Template Reset

Description

The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the 'woolentor_template_store' function. This makes it possible for authenticated attackers, with contributor access and above to access the nonce used to access this function and set a blank template as the default template.

Affects Plugins

Plugin icon
woolentor-addons
Fixed in 2.8.2

References

CVE
CVE-2023-7067
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/860c2339-b2a9-4a4e-a186-07a5fb042b06

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Lucio Sá
Verified
No
WPVDB ID
c5d0c22f-0d1d-4834-9dc2-307dda61cad2

Timeline

Publicly Published
2024-04-18 (about 2 years ago)
Added
2024-04-19 (about 2 years ago)
Last Updated
2024-04-19 (about 2 years ago)

Other

Published
Title
Published
2024-01-04
Title
Cloudflare < 4.12.3 - Missing Authorization via initProxy
Published
2025-02-03
Title
Slide Banners <= 1.3 - Missing Authorization
Published
2026-09-22
Title
10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion
Published
2026-08-17
Title
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More < 6.5 - Missing Authorization
Published
2023-12-21
Title
Uncode Core < 2.8.9 - Authenticated (Subscriber+) Arbitrary File Deletion