WordPress Newsup Theme Missing Capability Check Vulnerability Allowing Unauthorized Plugin Installation

A vulnerability exists in the Newsup theme for WordPress, specifically in versions through 5.0.10. The issue arises from a lack of proper capability checks in the 'newsup_admin_info_install_plugin()' function, allowing unauthorized users to install the 'ansar-import' plugin. This vulnerability could be exploited by unauthenticated attackers to manipulate plugin installations on affected WordPress sites.

Impact

Exploitation of this vulnerability allows for unauthorized installation of plugins, which could lead to further security issues, such as malicious plugins being activated and potentially compromising the site.

Reproduction

To reproduce this vulnerability, an unauthenticated user can send a request to the WordPress site with the 'action' parameter set to 'install_act_plugin'. This request will bypass the missing capability check and trigger the installation of the 'ansar-import' plugin.

Remediation

Users are advised to update the Newsup theme to version 5.0.11 or later, where this vulnerability has been patched.