WordPress CVEs

Description

The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userback_get_json function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract plugin's configuration data including the Userback API access token and site's posts/pages contents, including those that have private and draft status.

Affected WordPress components

• Userback Plugin · userback
  Confirmed match Active
  Up to and including 1.0.15
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• userback Userback — Up to and including 1.0.15

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/userback/tags/1.0.15/index.php#L148
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/1add8693-20df-431e-ad3b-b23322f1fa03?source=cve
• nvd.nist.gov Official NVD record