Description

WordPress Plugin Absolute Privacy is prone to a security bypass vulnerability. Attackers can exploit this vulnerability to bypass authentication mechanism and gain administrative access to an affected application, which may aid in further attacks. WordPress Plugin Absolute Privacy version 2.0.5 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.0.6 or latest

References

http://wordpress.org/support/topic/absolute-privacy-badly-broken

http://secunia.com/advisories/48040/

Related Vulnerabilities

WordPress Plugin Quiz and Survey Master (QSM)-Easy Quiz and Survey Maker Cross-Site Scripting (7.1.13)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce SQL Injection (5.7.23)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-42497)

WordPress Improper Privilege Management Vulnerability (CVE-2019-20043)

WordPress Plugin WordPress Landing Page-Squeeze Page-Responsive Landing Page Builder Free-WP Lead Plus X Multiple Vulnerabilities (0.98)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass