Hostinger <= 1.9.7 - Missing Authorization to Maintenance Mode Activation
highThe Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode.
- CVSS:
- 7.3
- Affected:
- up to 1.9.7
- Fixed in:
- 1.9.8
- Disclosed:
- Jan 5, 2024