On a WordPress Multisite network, Forminator's bundled WPMU DEV Hub Connector only checked the single-site manage_options capability before connecting the site to the Hub, handing out its auth nonce, storing the network-wide API key and serving its sync/logout REST endpoints. Any single-site administrator could therefore connect the whole network... Weiterlesen: Missing Authorization in Forminator Forms Hub Connector
Intelligence View
⚡ tsecurity.de Intelligence
Missing Authorization in Forminator Forms Hub Connector
On a WordPress Multisite network, Forminator's bundled WPMU DEV Hub Connector only checked the single-site manage_options capability before connecting the site…
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar