Low-Privileged Attackers Can Bypass Authorization in Social Networks Auto-Poster Plugin

CVE-2020-36831

Summary

The NextScripts Social Networks Auto-Poster plugin for WordPress has a vulnerability that allows low-privileged users, such as subscribers, to bypass authorization controls. Due to missing capability checks in various user privilege functions, these users can execute actions that should be restricted to administrative users. This vulnerability affects multiple security functions in the plugin, potentially compromising the integrity and security of WordPress sites utilizing this plugin version 4.3.17 or earlier. Website administrators are advised to update to the latest version to mitigate the risk.

References