REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion
published August 16, 2023
CVSS
—
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is
The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments
The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.3th percentile
Published
2023-08-16T11:03Z
EPSS history
Timeline
16 AUG 11:03Z
REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion