Security restrictions bypass in Motors – Car Dealer & Classified Ads WordPress Plugin

1) Improper access control

EUVDB-ID: #VU21239

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote non-authenticated attacker can gain unauthorized access to the application and import or export data, or permanently inject HTML and scripting code.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Motors – Car Dealer & Classified Ads WordPress Plugin: 1.3.8 - 1.4.0

External links

http://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-motors-car-dealer-classified-ads-p...

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.