Beschreibung
WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.
CVSS 9.8EPSS 0.347%Risiko 1.01
Quelle öffnen- Veröffentlicht
- 2026-06-04 14:16:32
- Betroffene Versionen
- <= 1.4.6
- Typ
- Webanwendung
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H