Wp Shamsi Vulnerabilities

The WP Shamsi plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'file_batch_delete_callback' and 'file_delete' functions in versions up to, and including, 4.3.3. This makes it possible for subscriber-level attackers to delete attachments.

CVSS:

4.3

Affected:

up to 4.3.3

Fix:

No patched version reported

Disclosed:

Feb 28, 2023

CVE-2023-0335 on NVD →

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactiv...

CVSS:

6.5

Affected:

up to 4.1.0

Fixed in:

4.1.1

Disclosed:

Nov 28, 2022

CVE-2022-4555 on NVD →

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when saving plugin settings in versions up to, and including, 4.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin's options and active a pro...

CVSS:

4.3

Affected:

up to 4.1.1

Fixed in:

4.2.0

Disclosed:

Sep 5, 2022

CVE-2022-38058 on NVD →