CVE-2020-36702CWE-862

Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization

Medium · published June 7, 2023

CVSS v3.1
5.5
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14.7. This is due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber+ roles to update the plugin's settings.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-06-07T01:51Z
EPSS history
Timeline
  • 07 JUN 01:51Z
    Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization
    cvelistv5