WordPress CVEs

Description

The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary users.

Affected WordPress components

• Flynax Bridge Plugin · flynax-bridge
  Confirmed match Abandoned
  Up to and including 2.2.0
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• v1rustyle Flynax Bridge — Up to and including 2.2.0
• flynax flynax_bridge — Up to and including 2.2.0

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/flynax-bridge/trunk/src/API.php#L386 Product, Technical Description
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3306501/
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/dcb33d02-d384-4dff-91e1-c49e86b97d6e?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record