Wp Client Reports Vulnerabilities

The WP Client Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.22. This is due to missing or incorrect nonce validation on the wp_client_reports_send_email_report_from_ajax() function. This makes it possible for unauthenticated attackers to send email report...

CVSS:

4.3

Affected:

up to 1.0.22

Fixed in:

1.0.23

Disclosed:

Apr 12, 2024

CVE-2024-32439 on NVD →

The WP Client Reports plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.0.16 via the wp_client_reports_send_email_report_from_ajax() function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level permissions an...

CVSS:

4.3

Affected:

up to 1.0.16

Fixed in:

1.0.17

Disclosed:

Jan 20, 2023

CVE-2023-23978 on NVD →