Live CSS Preview WordPress Plugin Missing Authorization Vulnerability in Versions Through 2.0.0
Vulnerability
A vulnerability exists in the Live CSS Preview plugin for WordPress, all versions through 2.0.0, allowing unauthorized data modification. This issue arises from a missing capability check on the 'wp_ajax_frontend_save' AJAX endpoint. As a result, authenticated attackers with Subscriber-level access and above can manipulate the plugin's CSS settings.
Impact
Exploitation of this vulnerability allows authenticated users with Subscriber-level access and above to unauthorizedly modify the plugin's CSS settings.
Remediation
No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.