ClickCease Click Fraud Protection <= 3.2.4 - Improper Authorization to sensitive information exposure via get_settings
medium
The ClickCease Click Fraud Protection plugin for WordPress is vulnerable to unauthorized access of data due to an improper capability check on the get_settings function in all versions up to, and including, 3.2.4. This makes it possible for authenticated attackers, with author access and above, to retrieve the plugin's...
- CVSS:
- 4.3
- Affected:
- up to 3.2.4
- Fixed in:
- 3.2.5
- Disclosed:
- May 6, 2024
CVE-2023-6810 on NVD →
ClickCease Click Fraud Protection <= 3.2.7 - Cross-Site Request Forgery
medium
The ClickCease Click Fraud Protection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due to missing or incorrect nonce validation on the save_settings() function. This makes it possible for unauthenticated attackers to update settings via a forged r...
- CVSS:
- 4.3
- Affected:
- up to 3.2.7
- Fixed in:
- 3.2.8
- Disclosed:
- Apr 26, 2024
CVE-2024-33678 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database