The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of the administrative dashboard. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to call functions and delete and/or upload files.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCleantalk Security \& Malware Scan
APPCleantalk< 2.51
Powiązane podatności
Nieuwierzytelniony upload plików w pluginie CleanTalk Security & Malware Scan dla WordPress
The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from pote...
CleanTalk Anti-Spam: nieautoryzowana instalacja wtyczek przez bypass autoryzacji
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbit...
The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids bef...