The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
Weakness
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wp-invoice | Usabilitydynamics | * | 4.1.1 (excluding) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/122.html
- https://cwe.mitre.org/data/definitions/233.html
- https://cwe.mitre.org/data/definitions/58.html
References
- http://www.pritect.net/blog/wp-invoice-4-1-1-security-vulnerabilities
- https://wordpress.org/plugins/wp-invoice/#developers
- https://wpvulndb.com/vulnerabilities/8378
- http://www.pritect.net/blog/wp-invoice-4-1-1-security-vulnerabilities
- https://wordpress.org/plugins/wp-invoice/#developers
- https://wpvulndb.com/vulnerabilities/8378