Spectra – WordPress Gutenberg Blocks, ad09c1318a40ce55081853122457f41a268588f2
- CVE, Research URL
- Application
- Published on
- Jan 25, 2023
- Research Description
- Spectra Gutenberg Blocks – Website Builder for the Block Editor [ultimate-addons-for-gutenberg] < 2.3.2 Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization Checks The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the import_wpforms, import_block, and activate_plugin functions called via AJAX actions in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, such as subscribers, to activate arbitrary plugins and import blocks and forms from WPForms.
- Affected versions
-
max 2.3.2.
- Status
-
vulnerable