CVE-2024-10535
Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion
Résumé
Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unused_thumbnails() function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails in the video-wc-gallery-thumb directory.
Références
- advisory github.com
- advisory nvd.nist.gov
- web plugins.trac.wordpress.org
- web plugins.trac.wordpress.org
- web wordfence.com