ColorMag, e2f429cd9dc53e7801fbc143441fc6fb2af47c10
- CVE, Research URL
- Home page URL
- Application
- Published on
- Jan 19, 2024
- Research Description
- ColorMag [colormag] < 3.1.3 ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate arbitrary plugins.
- Affected versions
-
Min -, max 3.1.3.
- Status
-
vulnerable