Lafka WordPress Plugin Missing Authorization Vulnerability in Theme Option Update
Vulnerability
A vulnerability exists in the Lafka Plugin for WordPress, all versions through 7.1.0, due to a lack of proper capability checks on the 'lafka_options_upload' AJAX function. This flaw allows authenticated attackers with subscriber-level access and above to modify a theme option that overrides the site.
Impact
Exploitation of this vulnerability allows for unauthorized modification of theme options, potentially leading to unauthorized changes in site appearance or functionality.
Remediation
No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.