Description (CNA)
The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle::signup' and the 'fsSellerRole::add_role_seller' functions not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can be exploited with the 'fs_type' parameter if the Flex Store Seller plugin is also activated.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CMSSuperHeroes / Flex Store Users | affected 0 through 1.1.0 |
CWE
CWE-269
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a2fc40ed-a6af-4069-be63-cb75e98cc98a?source=cve
- https://themeforest.net/item/autosmart-automotive-car-dealer-wordpress-theme/20322930
ADP enrichment
No English description supplied.
No references supplied.