Description (CNA)
The Social Streams plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their user meta information in the update_user_meta() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their user type to that of an administrator.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| steverio / Social Streams | affected 0 through 1.0.1 |
CWE
CWE-272
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f01b88-6f93-4ee8-8d59-9165ebcd4dd1?source=cve
- https://plugins.trac.wordpress.org/browser/social-streams/trunk/src/php/JsonAPI.php#275
ADP enrichment
No English description supplied.
No references supplied.