CVE-2021-4335

Katalog CVE

CVSS 6.3 · Medium EPSS 0,40%

Kerentanan Improper Authorization pada radykal fancy product designer. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account.

Rincian

Terbit di NVD

20 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wordfence.com/threat-intel/vulnerabilities/id/644624d8-c193-4ee6-bc82-7ccda5d7f2ac?source=cve advisory pihak ketiga
• https://support.fancyproductdesigner.com/support/discussions/topics/13000029981 release notes