WordPress File Sharing Plugin, 5ec10b852355c81b4d0f20f86f2b248af6bf4977

CVE, Research URL: 5ec10b852355c81b4d0f20f86f2b248af6bf4977
Home page URL: Security reports for WordPress File Sharing Plugin
Application: WordPress File Sharing Plugin
Published on: Aug 06, 2022
Research Description: Secure Client Portal and Private File Sharing Plugin – User Private Files [user-private-files] < 1.1.2 Frontend File Manager & Sharing – User Private Files <= 1.1.1 - Missing Authorization The Frontend File Manager & Sharing – User Private Files plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.1.1. This is due to missing capability checks and nonce validation on several functions such as dpk_upvf_rmv_file(), dpk_upvf_rmv_access(), and dpk_upvf_update_doc(). This makes it possible for unauthenticated attackers to modify several settings and modify files (via deletion and settings updates).
Affected versions: max 1.1.2.
Status: vulnerable