CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 117)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
Tutor LMS – eLearning and online course solution
≤4.0.8Update to 4.0.9
- Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
Tutor LMS – eLearning and online course solution
≤4.0.8Update to 4.0.9
- Medium4.3Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()
SEO Booster
≤7.4.7Update to 7.4.8
- High8.8Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
Save as PDF Plugin by PDFCrowd
≤4.6.1Update to 4.6.2
- Medium6.1Reflected Cross-Site Scripting via 'keyword' Parameter
Pochipp
≤1.20.2Update to 1.20.3
- Critical9.8Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Gravity Forms
≤3.1.0.4Update to 3.1.1
- Critical9.1Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2Update to 1.57.3
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action
Divi Essentials
≤5.8.1Update to 5.9.0
- Medium5.3Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.33Update to 3.0.0
- Medium6.5Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.33Update to 3.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
WPComplete
≤2.9.9.0Update to 2.9.9.1
- Medium5.31.4.1 - Missing Authorization
TikTok
1.2.0 – 1.4.1Update to 1.4.2
- Medium4.3Authenticated (Author+) Information Exposure
Meow Gallery
≤5.5.4Update to 5.5.5
- Medium5.3Unauthenticated Arbitrary Shortcode Execution
Meow Gallery
≤5.5.4Update to 5.5.5
- Medium4.3Cross-Site Request Forgery
Sign-up Sheets
≤2.3.0Update to 2.4.0
- High7.5Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
WP Photo Album Plus
≤9.2.09.002Update to 9.3.01.003
- Medium5.3Missing Authorization
Tripzzy – Travel Engine System
≤1.5.0Update to 1.5.1
- Medium5.3Missing Authorization
Tripzzy – Travel Engine System
≤1.5.0Update to 1.5.1
- High7.2Authenticated (Admin+) Privilege Escalation
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium5.3Unauthenticated Content Injection
To Do List Member
≤1.6No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
Unlimited Elements for Elementor
≤2.0.19Update to 2.0.20
- Medium4.3Authenticated (Admin+) Insecure Direct Object Reference
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0
- Low2.7Authenticated (Admin+) Insecure Direct Object Reference
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Master Slider – Responsive Touch Slider
<3.11.5Update to 3.11.5
- High7.2Authenticated (Admin+) Privilege Escalation
Import and export users and customers
≤2.5.1Update to 2.5.2
- Medium6.6Authenticated (Admin+) PHP Object Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- High7.2Authenticated (Admin+) Arbitrary File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery
Import and export users and customers
≤2.4.4Update to 2.4.5
- Low2.7Authenticated (Admin+) Insecure Direct Object Reference
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0