YITH WooCommerce Wishlist up to and including 4.10.0 exposes YITH_WCWL_Wishlists::create() through the unauthenticated REST route /wp-json/yith/wishlist/v1/lists, which registers permission_callback => '__return_true'. Because create() accepted a caller-supplied user_id without checking who was asking, an unauthenticated attacker could have a... Weiterlesen
Intelligence View
⚡ tsecurity.de Intelligence
Incorrect Permissions in YITH WooCommerce Wishlist Wishlist Creation
YITH WooCommerce Wishlist up to and including 4.10.0 exposes YITH_WCWL_Wishlists::create() through the unauthenticated REST route /wp-json/yith/wishlist/v1/lists, which registers permission_callback => '__return_true'.…
Reagiere als Erste:r — dein Feedback zählt!
SOCIAL SHARE CARD GENERATOR