MSHOP MY SITE <= 1.1.7 - Missing Authorization via update_settings
mediumThe MSHOP MY SITE plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_settings function in versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings...
- CVSS:
- 4.3
- Affected:
- up to 1.1.7
- Fixed in:
- 1.1.8
- Disclosed:
- Nov 7, 2023