WordPress CVEs

Description

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one.

Affected WordPress components

• Image Optimizer, Resizer and CDN – Sirv Plugin · sirv
  Confirmed match Active
  Up to and including 7.2.7; Before 7.2.8
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• sirv Image Optimizer, Resizer and CDN – Sirv — Up to and including 7.2.7
• sirv sirv — Before 7.2.8

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5197 Patch
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5338 Patch
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/229490c3-d820-4831-b105-a429512c2c60?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record