Unauthorized Modification of Data Passwords in The Reviews Feed Plugin

CVE-2024-8199

Summary

The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress contains a security flaw that allows authorized users with Subscriber-level access or higher to modify sensitive data. This vulnerability arises due to a missing capability check within the 'update_api_key' function, potentially enabling attackers to change API Key options without proper authorization. All versions up to and including 1.1.2 are impacted, highlighting the need for prompt action to secure affected installations.

References