Print My Blog – Print, PDF, & eBook Converter WordPress Plugin, 8f1161f2f4cbfede1813502c1a1e298519419671
- CVE, Research URL
- Home page URL
-
Security reports for Print My Blog – Print, PDF, & eBook Converter WordPress Plugin
- Published on
- Jun 20, 2022
- Research Description
- Print My Blog – Print, PDF, & eBook Converter WordPress Plugin [print-my-blog] < 3.15.9 Print My Blog – Print, PDF, & eBook Converter <= 3.15.8 - Unprotected AJAX Actions The Print My Blog – Print, PDF, & eBook Converter plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions hooked via AJAX actions in versions up to, and including, 3.15.8. This makes it possible for authenticated attackers with subscriber-level permissions and above to modify the plugin's settings and inject malicious JavaScript. The affected AJAX actions are: wp_ajax_pmb_save_project_main, wp_ajax_pmb_post_search, wp_ajax_pmb_add_print_material, wp_ajax_pmb_reduce_credits, wp_ajax_pmb_report_error, and wp_ajax_pmb_duplicate_print_material. This could also be exploited via Cross-Site Request Forgery.
- Affected versions
-
max 3.15.9.
- Status
-
vulnerable