Insufficient Option Restrictions in Stops Core Theme and Plugin Updates for WordPress
CVE-2019-15650

4.3MEDIUM

Key Information:

Vendor

Wordpress
Status
Easy Updates Manager
Vendor
CVE Published:
27 August 2019

What is CVE-2019-15650?

The Stops Core Theme and Plugin Updates plugin for WordPress has a weakness stemming from inadequate restrictions on option changes, specifically concerning the disabling of unattended theme updates. This flaw arises from an error in the nonce verification process, which may lead to unauthorized modification of key settings in the plugin. Attackers could exploit this vulnerability to manipulate plugin behavior, potentially compromising the integrity of theme updates and overall site security.

References

https://wordpress.org/plugins/stops-core-theme-and-plugin...
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9837
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.