WordPress CVEs

Description

Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.

Affected WordPress components

• dtracker Plugin · dtracker
  Confirmed match Homeless
  From unspecified (including) to 1.5 (excluding); Version 1.5
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• ITFlux DTracker — From unspecified (including) to 1.5 (excluding)
• dtracker_project dtracker — Version 1.5

References

• www.securityfocus.com http://www.securityfocus.com/bid/96890 Third Party Advisory, VDB Entry
• www.vapidlabs.com http://www.vapidlabs.com/advisory.php?v=186 Exploit, Third Party Advisory
• wordpress.org https://wordpress.org/plugins/dtracker/ Third Party Advisory
• nvd.nist.gov Official NVD record