Incorrect Access Control Vulnerability in WP Image Zoom by WordPress
CVE-2018-1000510

6.5MEDIUM

Key Information:

Vendor
WordPress
Status
Image Zoom
Vendor
CVE Published:
26 June 2018

Summary

An access control vulnerability has been identified in WP Image Zoom version 1.23, which allows any logged-in user to exploit AJAX settings. This flaw can lead to a denial of service condition, potentially affecting the functionality of the application. The vulnerability can be triggered intentionally or inadvertently through Cross-Site Request Forgery (CSRF) attacks. It is essential for users to upgrade to version 1.24, where this issue has been addressed.

References

https://advisories.dxw.com/advisories/wp-image-zoom-dos/
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.