YITH WooCommerce Product Slider Carousel, d41f6c2de996f217114b829051c013cc7fe3a490

CVE, Research URL: d41f6c2de996f217114b829051c013cc7fe3a490
Home page URL: Security reports for YITH WooCommerce Product Slider Carousel
Application: YITH WooCommerce Product Slider Carousel
Published on: Nov 11, 2022
Research Description: YITH WooCommerce Product Slider Carousel [yith-woocommerce-product-slider-carousel] <= 1.16.0 (unfixed) YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the create_log_file function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to download the logs of the plugin which can contain sensitive information. Please note that the unpatched plugins from this developer are the FREE versions of the plugin that were available on the WordPress.org repository. The developer is still maintaining the premium versions of the plugins which have been patched.
Affected versions: max 1.16.0.
Status: vulnerable