Themeflection Numbers <= 1.8.1 - Authenticated(Subscriber+) Privilege Escalation via tf_numb_save_licenses
highThe Themeflection Numbers plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the tf_numb_save_licenses function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site o...
- CVSS:
- 8.8
- Affected:
- up to 1.8.1
- Fixed in:
- 2.0.1
- Disclosed:
- Mar 27, 2023