Droip WordPress Plugin Missing Authorization Vulnerability in AJAX Hooks
Vulnerability
A vulnerability exists in the Droip plugin for WordPress, in all versions through 2.2.0, due to a lack of proper capability checks in the droip_post_apis() function. This flaw allows authenticated attackers with Subscriber-level access and above to misuse AJAX hooks to perform various actions. Potential consequences include unauthorized deletion or creation of posts, duplication of posts, modification of settings, manipulation of users, and more.
Impact
Exploitation of this vulnerability could lead to unauthorized data modification, including arbitrary post deletion and creation, post duplication, settings changes, and user manipulation.
Remediation
No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.