CWE-862Vulnerability type

WordPress Missing Authorization vulnerabilities (page 1314)

AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Missing Authorization vulnerabilities (page 1314)
Severity	Vulnerability	CVE	Installs	Published
High7.5	Improper Input Validation Invite Anyone≤1.3.15Update to 1.3.16	CVE-2017-18545	—	Mar 22, 2017
High8.8	Cross-Site Request Forgery Invite Anyone<1.3.16Update to 1.3.16	CVE-2017-18544	—	Mar 22, 2017
High7.5	Email Injection Invite Anyone<1.3.16Update to 1.3.16	CVE-2017-18543	—	Mar 22, 2017
Critical9.8	SQL Injection Search Everything≤8.1.6Update to 8.1.7	CVE-2017-18571	—	Mar 20, 2017
Critical9.8	SQL Injection Membership Simplified≤1.58No patch available	CVE-2017-1002009	—	Mar 17, 2017
Medium5.3	Change of Email Invitation Content Invite Anyone<1.3.15Update to 1.3.15	CVE-2017-6955	—	Mar 17, 2017
Medium4.3	Authorization Bypass BuddyPress Docs<1.9.3Update to 1.9.3	CVE-2017-6954	—	Mar 17, 2017
High8.8	SQL Injection Membership Simplified<1.58Update to 1.58	CVE-2017-1002010	—	Mar 17, 2017
Critical9.8	Arbitrary File Download Membership Simplified≤1.58No patch available	CVE-2017-1002008	—	Mar 13, 2017
High7.5	Missing Authorization DTracker≤1.5No patch available	CVE-2017-1002006	—	Mar 13, 2017
High7.2	SQL Injection via subscriber_email parameter Mail Masta≤1.0No patch available	CVE-2017-6578	—	Mar 9, 2017
Critical9.8	SQL Injection PICA Photo Gallery≤1.0No patch available	CVE-2017-20247	—	Mar 9, 2017
Critical9.8	SQL Injection DTracker≤1.5No patch available	CVE-2017-1002004	—	Mar 8, 2017
Critical9.8	SQL Injection DTracker≤1.5No patch available	CVE-2017-1002005	—	Mar 8, 2017
High7.5	Authorization Bypass DTracker≤1.5No patch available	CVE-2017-1002007	—	Mar 8, 2017
Medium6.1	HTML Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.0.31Update to 3.0.31	CVE-2017-18574	—	Mar 7, 2017
Critical9.8	Arbitrary File Upload Wp2android≤1.1.4No patch available	CVE-2017-1002003	—	Mar 7, 2017
Critical9.8	Arbitrary File Upload Mobile App Builder by WapPress≤1.05No patch available	CVE-2017-1002001	—	Mar 7, 2017
High8.8	Cross-Site Request Forgery via Press This WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6819	—	Mar 6, 2017
Medium6.4	Cross-Site Scripting via Media Metadata WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6814	—	Mar 6, 2017
Medium4.9	Arbitrary File Deletion WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6816	—	Mar 6, 2017
Medium6.4	Cross-Site Scripting via Taxonomy names WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6818	—	Mar 6, 2017
Medium6.1	Bypass URL Validation WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6815	—	Mar 6, 2017
Medium6.4	Authenticated Cross-Site Scripting in Youtube URL Embeds WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6817	—	Mar 6, 2017
High7.2	SQL Injection via id parameter Mail Masta≤1.0No patch available	CVE-2017-6576	—	Mar 5, 2017
High7.2	SQL Injection via filter_list Mail Masta≤1.0No patch available	CVE-2017-6574	—	Mar 5, 2017
Medium6.4	Authenticated Stored Cross-Site Scripting wordpress plugin rockhoist-badges≤1.2.2No patch available	CVE-2017-6102	—	Mar 3, 2017
Critical9.8	Security Bypass to Database Login adminer≤1.4.5No patch available	CVE-2017-20066	—	Mar 3, 2017
Medium6.1	Cross-Site Scripting via Cross-Site Request Forgery Atahualpa≤3.7.24No patch available	CVE-2024-27948	—	Mar 1, 2017
Medium6.4	Stored Cross-Site Scripting Contact Form Plugin≤4.0.1Update to 4.0.2	CVE-2017-20055	—	Mar 1, 2017

High7.5
Improper Input Validation
Invite Anyone
≤1.3.15Update to 1.3.16
CVE-2017-18545Mar 22, 2017
High8.8
Cross-Site Request Forgery
Invite Anyone
<1.3.16Update to 1.3.16
CVE-2017-18544Mar 22, 2017
High7.5
Email Injection
Invite Anyone
<1.3.16Update to 1.3.16
CVE-2017-18543Mar 22, 2017
Critical9.8
SQL Injection
Search Everything
≤8.1.6Update to 8.1.7
CVE-2017-18571Mar 20, 2017
Critical9.8
SQL Injection
Membership Simplified
≤1.58No patch available
CVE-2017-1002009Mar 17, 2017
Medium5.3
Change of Email Invitation Content
Invite Anyone
<1.3.15Update to 1.3.15
CVE-2017-6955Mar 17, 2017
Medium4.3
Authorization Bypass
BuddyPress Docs
<1.9.3Update to 1.9.3
CVE-2017-6954Mar 17, 2017
High8.8
SQL Injection
Membership Simplified
<1.58Update to 1.58
CVE-2017-1002010Mar 17, 2017
Critical9.8
Arbitrary File Download
Membership Simplified
≤1.58No patch available
CVE-2017-1002008Mar 13, 2017
High7.5
Missing Authorization
DTracker
≤1.5No patch available
CVE-2017-1002006Mar 13, 2017
High7.2
SQL Injection via subscriber_email parameter
Mail Masta
≤1.0No patch available
CVE-2017-6578Mar 9, 2017
Critical9.8
SQL Injection
PICA Photo Gallery
≤1.0No patch available
CVE-2017-20247Mar 9, 2017
Critical9.8
SQL Injection
DTracker
≤1.5No patch available
CVE-2017-1002004Mar 8, 2017
Critical9.8
SQL Injection
DTracker
≤1.5No patch available
CVE-2017-1002005Mar 8, 2017
High7.5
Authorization Bypass
DTracker
≤1.5No patch available
CVE-2017-1002007Mar 8, 2017
Medium6.1
HTML Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.0.31Update to 3.0.31
CVE-2017-18574Mar 7, 2017
Critical9.8
Arbitrary File Upload
Wp2android
≤1.1.4No patch available
CVE-2017-1002003Mar 7, 2017
Critical9.8
Arbitrary File Upload
Mobile App Builder by WapPress
≤1.05No patch available
CVE-2017-1002001Mar 7, 2017
High8.8
Cross-Site Request Forgery via Press This
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6819Mar 6, 2017
Medium6.4
Cross-Site Scripting via Media Metadata
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6814Mar 6, 2017
Medium4.9
Arbitrary File Deletion
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6816Mar 6, 2017
Medium6.4
Cross-Site Scripting via Taxonomy names
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6818Mar 6, 2017
Medium6.1
Bypass URL Validation
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6815Mar 6, 2017
Medium6.4
Authenticated Cross-Site Scripting in Youtube URL Embeds
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6817Mar 6, 2017
High7.2
SQL Injection via id parameter
Mail Masta
≤1.0No patch available
CVE-2017-6576Mar 5, 2017
High7.2
SQL Injection via filter_list
Mail Masta
≤1.0No patch available
CVE-2017-6574Mar 5, 2017
Medium6.4
Authenticated Stored Cross-Site Scripting
wordpress plugin rockhoist-badges
≤1.2.2No patch available
CVE-2017-6102Mar 3, 2017
Critical9.8
Security Bypass to Database Login
adminer
≤1.4.5No patch available
CVE-2017-20066Mar 3, 2017
Medium6.1
Cross-Site Scripting via Cross-Site Request Forgery
Atahualpa
≤3.7.24No patch available
CVE-2024-27948Mar 1, 2017
Medium6.4
Stored Cross-Site Scripting
Contact Form Plugin
≤4.0.1Update to 4.0.2
CVE-2017-20055Mar 1, 2017