Non notée
CVE-2021-24968 The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the…
Description
The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ultimate FAQ – WordPress FAQ and Accordion Plugin 2.1 | premières → < 2.1.2 | 2.1.2 |