Description (CNA)
The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazale_sds_delete_entries_table_row() function. This makes it possible for unauthenticated attackers to completely wipe database tables such as wp_users.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ghazale / Custom Searchable Data Entry System | affected 0 through 1.7.1 |
CWE
CWE-862
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/245d89e5-52cc-44b1-a858-0ca0aacb4e26?source=cve
- https://www.wordfence.com/blog/2020/03/active-attack-on-zero-day-in-custom-searchable-data-entry-system-plugin/
ADP enrichment
No English description supplied.
No references supplied.