WordPress WPSubscription Plugin Authorization Bypass Vulnerability Allowing Insecure Direct Object References

A vulnerability allowing authorization bypass through user-controlled keys has been identified in the WordPress WPSubscription plugin, affecting versions through 1.8.10. This issue arises from incorrectly configured access control security levels, which could be exploited to bypass authorization and access sensitive data or functionalities.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files or data, allowing for interaction with the database or other critical components.

Remediation

Users of the WPSubscription WordPress plugin should update to version 1.8.11 or later. Patchstack users can enable auto-updates for vulnerable plugins.