Freemius SDK <= 2.4.2 - Missing Authorization Checks
mediumThe Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...
- CVSS:
- 6.3
- Affected:
- up to 1.9.2
- Fixed in:
- 1.9.2
- Disclosed:
- Mar 4, 2022