Laposta Signup Embed Vulnerabilities

Update the WordPress Laposta Signup Embed plugin to the latest available version (at least 1.1.1). Unknown discovered and reported this Broken Access Control vulnerability in WordPress Laposta Signup Embed Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a...

Affected:

up to 1.1.1

Fixed in:

1.1.1

Disclosed:

Sep 6, 2023

Update the WordPress Laposta Signup Embed plugin to the latest available version (at least 1.1.1). Unknown discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Laposta Signup Embed Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted action...

Affected:

up to 1.1.1

Fixed in:

1.1.1

Disclosed:

Sep 6, 2023

The Laposta Signup Embed plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.0. This is due to a missing capability check on the ajaxResetCache function. This makes it possible for subscriber-level attackers or higher to clear the plugin's cache.

CVSS:

4.3

Affected:

up to 1.1.1

Fixed in:

1.1.1

Disclosed:

Sep 5, 2023

The Laposta Signup Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the ajaxResetCache function. This makes it possible for unauthenticated attackers to clear the plugin's cache via a forged request gr...

CVSS:

4.3

Affected:

up to 1.1.1

Fixed in:

1.1.1

Disclosed:

Sep 5, 2023

The Laposta Signup Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the ajaxResetCache function. This makes it possible for unauthenticated attackers to clear the plugin's cache via a forged request gr...

Affected:

up to 1.1.1

Fixed in:

1.1.1

Disclosed:

Sep 5, 2023

The Laposta Signup Embed plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.0. This is due to a missing capability check on the ajaxResetCache function. This makes it possible for subscriber-level attackers or higher to clear the plugin's cache.

Affected:

up to 1.1.1

Fixed in:

1.1.1

Disclosed:

Sep 5, 2023