Wp Schema Pro Vulnerabilities

The Schema Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability check in all versions up to, and including 2.7.15. This makes it possible for authenticated attackers, with contributor-level access and above, to access arbitrary custom fields.

CVSS:

4.3

Affected:

up to 2.7.15

Fixed in:

2.7.16

Disclosed:

Mar 4, 2024

CVE-2024-1564 on NVD →

The Schema Pro plugin for WordPress is vulnerable to unauthorized access, modification, or loss of data due to a missing capability check on an unknown function in versions up to, and including, 2.7.8. This makes it possible for authenticated attackers, with contributor-level access and above, to make use of the unprot...

CVSS:

5.4

Affected:

up to 2.7.8

Fixed in:

2.7.9

Disclosed:

Jul 27, 2023

CVE-2023-36683 on NVD →

The Schema Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.7. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administr...

CVSS:

6.5

Affected:

up to 2.7.7

Fixed in:

2.7.8

Disclosed:

Jul 21, 2023

CVE-2023-36682 on NVD →