Description

WordPress Plugin Advanced Access Manager is prone to multiple vulnerabilities, including privilege escalation and information disclosure vulnerabilities. An attacker may leverage these issues to bypass the expected capabilities check and perform otherwise restricted actions, or to obtain sensitive information that may help in launching further attacks. WordPress Plugin Advanced Access Manager version 6.6.1 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 6.6.2 or latest

References

https://www.wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access-manager/

https://plugins.svn.wordpress.org/advanced-access-manager/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin Coming soon and Maintenance mode Unspecified Vulnerability (3.5.4)

Oracle JRE CVE-2012-1532 Vulnerability (CVE-2012-1532)

WordPress Plugin Xorbin Digital Flash Clock Cross-Site Scripting (1.0)

PHP Other Vulnerability (CVE-2007-3790)

WordPress Plugin File Manager Pro Arbitrary File Upload (8.3.4)

Severity

High

Classification

CVE-2020-35934 CVE-2020-35935 CWE-200 CWE-264 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update