Description

WordPress Plugin CF7 Manual Spam Blocker is prone to a privilege escalation vulnerability. Exploiting this issue may allow attackers to bypass the expected capabilities check and perform otherwise restricted actions; other attacks are also possible. WordPress Plugin CF7 Manual Spam Blocker version 1.0 is vulnerable.

Remediation

Update to plugin version 1.1.0 or latest

References

https://www.wordfence.com/blog/2019/05/privilege-escalation-flaw-present-in-slick-popup-plugin/

Related Vulnerabilities

WordPress Plugin Appointment Booking Calendar SQL Injection (1.1.23)

WordPress Plugin YITH Advanced Refund System for WooCommerce Security Bypass (1.0.10)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-3833)

LimeSurvey Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-1000658)

Joomla Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-7984)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Privilege Escalation