Popis
WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.
CVSS 9.8EPSS 0.347%Riziko 1.01
Zobraziť zdroj- Zverejnené
- 2026-06-04 14:16:32
- Dotknuté verzie
- <= 1.4.6
- Typ
- Webová aplikácia
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H