Classified Pro WordPress Theme Missing Authorization Vulnerability Allowing Arbitrary Plugin Installation
Vulnerability
A vulnerability exists in the Classified Pro theme for WordPress, in all versions through 1.0.14, allowing unauthorized plugin installations. This issue arises from a missing capability check in the 'cwp_addons_update_plugin_cb' function. Authenticated attackers with subscriber-level access or higher can exploit this vulnerability to install arbitrary plugins on the affected site's server, potentially leading to remote code execution. The required nonce for this vulnerability is located in the CubeWP Framework plugin.
Impact
Exploitation of this vulnerability could allow for arbitrary plugin installation, which may be used to execute malicious code on the server.
Remediation
No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected theme.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.