Connect to external APIs – WPGetAPI, 89d2b0cb158117bdc01ff2aa0f0b5a2b8217df1c
- CVE, Research URL
- Application
- Published on
- Oct 02, 2023
- Research Description
- WPGet API – Connect to any external REST API [wpgetapi] < 2.2.2 WPGetAPI 2.1.0 - 2.2.1 - Authenticated (Subscriber+) Arbitrary Options Update The WPGetAPI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_endpoints() function in versions 2.1.0 - 2.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options which can be leveraged for privilege escalation.
- Affected versions
-
Min 2.1.0, max 2.2.2.
- Status
-
vulnerable