Vk Block Patterns Vulnerabilities

The VK Block Patterns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vbp_clear_patterns_cache() function in versions up to, and including, 1.31.0. This makes it possible for unauthenticated attackers to clear the patterns cache.

CVSS:

5.3

Affected:

up to 1.31.0

Fixed in:

1.31.1.1

Disclosed:

Apr 22, 2024

CVE-2024-32826 on NVD →

The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing or incorrect nonce validation on the vbp_clear_patterns_cache() function. This makes it possible for unauthenticated attackers to clear the patterns cache via a f...

CVSS:

4.3

Affected:

up to 1.31.1.1

Fixed in:

1.31.2.0

Disclosed:

Jan 19, 2024

CVE-2024-0623 on NVD →