Ultimate GDPR & CCPA Compliance Toolkit < 2.5 - Unauthenticated Plugin Settings Export and Import

Description

The plugin used the is_admin() method as an authorisation check, which does not check if the user is a an administrator. This could allow unauthenticated attackers to import arbitrary plugin’s settings and redirect all traffic to an external malicious website for example.

Even though proper capability checks have been added in 2.5, it seems that the attack could still be performed via CSRF as nonces were not added.