WordPress CVEs

Description

The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_reset_map() and amm_save_map_api() functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to update the map API and reset maps.

Affected WordPress components

• Multi Location Marker Plugin · add-multiple-marker
  Confirmed match Active
  Up to and including 1.2
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• krishaweb Multi Location Marker — Up to and including 1.2

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/add-multiple-marker/tags/1.2/functions.php
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3433258/
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/f4f1467d-1f66-4e99-af44-9329cfe1efac?source=cve
• nvd.nist.gov Official NVD record