WordPress WooTumblog Plugin Missing Authorization Vulnerability Allowing Content Injection

A missing authorization vulnerability has been identified in the WordPress WooTumblog plugin, specifically in versions through 2.1.4. This vulnerability arises from incorrectly configured access control security levels, allowing unauthorized users to exploit the flaw.

Impact

Exploitation of this vulnerability could lead to unauthorized content injection into pages and posts, with the potential to insert phishing pages or other malicious content.

Remediation

Users are advised to deactivate the WooTumblog plugin and consider replacing it with an alternative, as this software is likely abandoned and will not receive further updates or fixes. Patchstack has issued a virtual patch to mitigate this vulnerability for users who subscribe to their service.