A vulnerability classified as critical has been found in MULTIDOTS WooCommerce Banner Management Plugin 1.1.0 on WordPress (E-Commerce Management Software). This affects an unknown code of the file class-woo-banner-management.php. The manipulation as part of a Request leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.

The bug was discovered 05/30/2018. The weakness was published 05/31/2018 (Website). It is possible to read the advisory at labs.threatpress.com. This vulnerability is uniquely identified as CVE-2018-11579 since 05/30/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:class-woo-banner-management.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Type

• E-Commerce Management Software

Vendor

• MULTIDOTS

Name

• WooCommerce Banner Management Plugin

Version

• 1.1.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion