CVE-2019-15816

EUVD-2019-6733
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
Affected Products (NVD)
VendorProductVersion
wpexpertdeveloperwp_private_content_plus
𝑥
< 2.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://blog.nintechnet.com/unauthenticated-options-change-vulnerability-in-wordpress-wp-private-content-plus-plugin/
https://wordpress.org/plugins/wp-private-content-plus/#developers
https://wpvulndb.com/vulnerabilities/9817
https://blog.nintechnet.com/unauthenticated-options-change-vulnerability-in-wordpress-wp-private-content-plus-plugin/
https://wordpress.org/plugins/wp-private-content-plus/#developers
https://wpvulndb.com/vulnerabilities/9817