wo_remove_client AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to delete arbitrary client. WP OAuth Server by Justin Greer <= 4.2.5 - Missing Authorization to Authenticated (Subscriber) Arbitrary Client Deletion
REPORT ID: f5e7e8e4-24fd-419e-ad80-ee378d249f80
The plugin contains a Missing Authorization vulnerability due to an incorrect capability check in the
You need to log in to view the vulnerability details.
Attributes
- Catgory
- WordPress Plugin
- Vulnerability Discovered
- 2022-11-28
- Report Published
- 2023-02-21
- Affected Version
- <= 4.2.3
Classification
- Type
- Missing Authorization
Support Us?
We would truly appreciate it if you bought us a bunny (food for a snow leopard).
