WordPress CVEs

Description

The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to missing capability checks on the REST API endpoint '/wise-analytics/v1/report'. This makes it possible for unauthenticated attackers to access sensitive analytics data including administrator usernames, login timestamps, visitor tracking information, and business intelligence data via the 'name' parameter granted they can send unauthenticated requests.

Affected WordPress components

• Wise Analytics Plugin · wise-analytics
  Confirmed match Active
  Up to and including 1.1.9
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• marcinlawrowski Wise Analytics — Up to and including 1.1.9

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wise-analytics/tags/1.1.9/src/Endpoints/ReportsEndpoint.php#L43
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wise-analytics/trunk/src/Endpoints/ReportsEndpoint.php#L43
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3446670/
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/d92c80cb-080b-4774-8c66-1d5cf68e771f?source=cve
• nvd.nist.gov Official NVD record