Improper access control in Ocean Extra - CVE-2019-16250

Vulnerability identifier: #VU21337

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green

CVE-ID: CVE-2019-16250

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: oceanwp

Affected software:
Ocean Extra

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions when processing data in the “includes/wizard/wizard.php” script. A remote non-authenticated attacker can bypass implemented security restrictions and include arbitrary CSS templates.

Install update from vendor's website.

• https://blog.nintechnet.com/settings-change-and-css-injection-in-wordpress-ocean-extra-plugin/