Description

WordPress Plugin miniOrange Discord Integration is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently call some of the AJAX actions and disable the app for example. WordPress Plugin miniOrange Discord Integration version 2.1.5 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.1.6 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:A91D0501-C2A9-4C6C-B5DA-B3FC29442A4F

https://plugins.svn.wordpress.org/miniorange-discord-integration/trunk/readme.txt

Related Vulnerabilities

Jboss EAP Observable Differences in Behavior to Error Inputs Vulnerability (CVE-2021-3642)

WordPress Plugin PHP Event Calendar for WordPress Arbitrary File Upload (1.6)

SugarCRM Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-17298)

Oracle HTTP Server CVE-2007-0280 Vulnerability (CVE-2007-0280)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-3469)

Severity

High

Classification

CVE-2022-3082 CWE-284 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass