WordPress Plugin Vulnerabilities

Radio Player < 2.0.74 - Missing Authorization to Settings Update

Description

The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_settings function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update plugin settings.

Affects Plugins

Plugin icon
radio-player
Fixed in 2.0.74

References

CVE
CVE-2023-4027
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2cc9f75d-f1a6-486b-b924-76ec618c5314

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Alex Thomas
Verified
No
WPVDB ID
e3e92c0b-783c-462a-bb6e-1d03d16f859a

Timeline

Publicly Published
2024-08-16 (about 1 year ago)
Added
2024-08-16 (about 1 year ago)
Last Updated
2024-08-17 (about 1 year ago)

Other

Published
Title
Published
2023-01-10
Title
Royal Elementor Addons < 1.3.60 - Subscriber+ Mega Menu Settings Update
Published
2025-10-30
Title
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) < 1.1.23.1 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation
Published
2022-02-24
Title
Total Upkeep < 1.14.14 - Subscriber+ Backup Disclosure
Published
2024-05-09
Title
Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler < 1.6.5 - Missing Authorization via Several AJAX Action
Published
2023-12-27
Title
Quiz And Survey Master < 8.1.17 - Unauthenticated Unauthorised Action