CVE-2018-11579 Missing authorization in n/a
Unauthenticated attackers can modify plugin settings via an exposed AJAX action in the WooCommerce Category Banner Management plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11579?
CVE-2018-11579 is a medium-severity missing authorization vulnerability in n/a, published on 31 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.
Weakness: CWE-287
Which versions are affected by CVE-2018-11579?
It affects 1 product.
Products include Multidots Woocommerce Category Banner Management.
How do I fix CVE-2018-11579?
No fix has been published for CVE-2018-11579 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-11579 being exploited?
There is no known exploitation of CVE-2018-11579 in the wild and no public exploit code.
Sources
Also known as GHSA-wj2m-wx8r-329h.