Description (CNA)
The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| smartdatasoft / Essential WP Real Estate | affected 0 through 1.1.3 |
CWE
CWE-463
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1a9e22-d174-43fc-aab6-f6968067a290?source=cve
- https://plugins.trac.wordpress.org/browser/essential-wp-real-estate/trunk/src/Common/Ajax/Ajax.php#L724
ADP enrichment
No English description supplied.
No references supplied.