Description
WordPress Plugin Malware Scanner is prone to a privilege escalation vulnerability. Exploiting this issue may allow attackers to bypass the expected capabilities check and perform otherwise restricted actions; other attacks are also possible. WordPress Plugin Malware Scanner version 4.7.2 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 4.7.3 or latest
References
https://sploitus.com/exploit?id=WPEX-ID:D95F761F-5385-482A-8C69-560E920267AF
https://plugins.svn.wordpress.org/miniorange-malware-protection/trunk/readme.txt
Related Vulnerabilities
phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-6610)
phpMyAdmin Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2013-3239)
WordPress Plugin Chat-Support Board-WordPress Chat Cross-Site Scripting (1.2.8)
WordPress Plugin Twitter LiveBlog Cross-Site Request Forgery (1.1.2)