Hard-coded credentials in Slick Popup: Contact Form 7 Popup Plugin - #VU18731

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU18731

Hard-coded credentials in Slick Popup: Contact Form 7 Popup Plugin - #VU18731

Published: June 10, 2019 / Updated: June 13, 2019


Vulnerability identifier: #VU18731
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: N/A
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Om Ak Solutions
Affected software:
Slick Popup: Contact Form 7 Popup Plugin

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to privilege escalation flaw in the Slick Popup plugin that allows any user with Subscriber privileges to create an administrator account with default credentials. A remote attacker can then use the created account to take over the website.

Default credentials are: 
Username: slickpopupteam
Password: OmakPass13#

Remediation

Update your plugin to the latest version.

Sources