WP Debugging, 939b6f2f-1e62-4a32-bcb7-2e0a340f6cc6

CVE, Research URL: 939b6f2f-1e62-4a32-bcb7-2e0a340f6cc6
Home page URL: Security reports for WP Debugging
Application: WP Debugging
Published on: -
Research Description: WP Debugging [wp-debugging] < 2.11.7 WP Dependency Installer < 4.3.1 - Subscriber+ Arbitrary Plugin Activation The wp-dependency-installer library, used in the plugins does not have authorisation and CSRF checks in its dependency_installer AJAX action with the activate method, allowing any authenticated users, such as subscriber to activate arbitrary plugin installed on the blog. Furthermore, despite having a capability check, the install method was missing any CSRF which could allow attackers to make a logged in admin install plugins defined in the wp-dependencies.json via a CSRF attack.
Affected versions: max 2.11.7.
Status: vulnerable