Unauthorized Plugin Installation and Activation Vulnerability Affects Gutenberg Blocks for WordPress & WooCommerce Plugin
Key Information
- Vendor
- Themehunk
- Status
- Vayu Blocks – Gutenberg Blocks For WordPress & WooCommerce
- Vendor
- CVE Published:
- 12 December 2024
Badges
Summary
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. This vulnerability was partially patched in version 1.1.1.
Affected Version(s)
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
Refferences
CVSS V3.1
Timeline
- 👾
Exploit exists.
Vulnerability published.
Vulnerability Reserved.