Orbit Fox by ThemeIsle, 655ce056f5c45d9d82efb41be6b110200c64c282

CVE, Research URL: 655ce056f5c45d9d82efb41be6b110200c64c282
Home page URL: Security reports for Orbit Fox by ThemeIsle
Application: Orbit Fox by ThemeIsle
Published on: Nov 12, 2018
Research Description: Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More [themeisle-companion] < 2.6.4 Orbit Fox by ThemeIsle <= 2.6.3 - Improper REST Capabilities Checks The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several REST API endpoints in versions up to, and including, 2.6.3. This makes it possible for unauthenticated attackers to perform unauthorized actions such as uploading arbitrary files that can be used for remote code execution.
Affected versions: max 2.6.4.
Status: vulnerable