EASY-JS-WPAPI Clientに管理者奪取の脆弱性、修正版なし
Summary
WordPressプラグインEASY-JS-WPAPI Client HANDLEの2.0以下で、認証なしに管理者資格情報を抜かれ、サイトを乗っ取られます。修正版は見つかっておらず、該当サイトはプラグインの無効化と資格情報の変更を急いでください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressプラグインEASY-JS-WPAPI Client HANDLEの2.0以下で、認証なしに管理者資格情報を抜かれ、サイトを乗っ取られます。修正版は見つかっておらず、該当サイトはプラグインの無効化と資格情報の変更を急いでください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| CVE の記録EASY-JS-WPAPI Client HANDLE for the WordPress REST-API |
≤ 2.0→ Not listed |
Not listed |
| CVE の記録EASY-JS-WPAPI Client HANDLE for the WordPress REST-API |
≤ 2.0→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com